WEBVTT 1 00:00:01.439 --> 00:00:08.320 Special Operations, Cobert SB. 2 00:00:08.320 --> 00:00:08.519 And I. 3 00:00:10.039 --> 00:00:16.800 The team House with your hosts Jack Murphy and David Park. 4 00:00:22.320 --> 00:00:25.879 Hey, folks, I'm Jack Murphy here with Dave Park. You 5 00:00:25.920 --> 00:00:28.559 will see him over there or on the wide shot. 6 00:00:28.600 --> 00:00:32.240 He looks a little lonely today because things are different. 7 00:00:32.640 --> 00:00:35.759 Dimitri had some car problems, so I am back in 8 00:00:35.799 --> 00:00:40.079 the production chair after like two three years since I've 9 00:00:40.079 --> 00:00:43.079 done this last so apologies if there's any technical issues. 10 00:00:43.880 --> 00:00:49.479 Our guest tonight is Deviant Olum. Deviant has a background 11 00:00:49.520 --> 00:00:52.799 in pen testing, red teaming, and physical security. 12 00:00:53.520 --> 00:00:55.560 A few years ago, Dave and I. 13 00:00:55.399 --> 00:00:59.560 Took a class of his at Defcon where he taught 14 00:00:59.640 --> 00:01:04.000 kem uh. He had a whole class about cracking safes 15 00:01:04.400 --> 00:01:08.439 and he also has a lot of information, interesting details 16 00:01:08.519 --> 00:01:11.959 about the history of intelligence services cracking into safes and 17 00:01:12.000 --> 00:01:14.239 how they went about that. So we're going to talk 18 00:01:14.280 --> 00:01:17.319 about all this stuff tonight. Uh, mister Deviant, thank you 19 00:01:17.359 --> 00:01:18.040 for joining us. 20 00:01:19.959 --> 00:01:22.000 Thanks so much for having me. This is exciting, glad 21 00:01:22.040 --> 00:01:22.439 to be here. 22 00:01:22.760 --> 00:01:25.079 Yeah, I've been a fan of yours for a long time. 23 00:01:26.079 --> 00:01:28.439 Can for viewers who might not know, because this is 24 00:01:28.519 --> 00:01:32.680 exciting stuff like this is movie stuff, and for people 25 00:01:32.719 --> 00:01:35.439 who might not know what pen testing is or physical 26 00:01:35.439 --> 00:01:38.159 pen testing like you are. You know, you're you're the 27 00:01:38.200 --> 00:01:41.640 analog Barbie in a digital world, right, but you're the 28 00:01:41.640 --> 00:01:44.159 guy on the ground. Can you tell us what pen 29 00:01:44.280 --> 00:01:47.439 testing and red teaming is and particularly in your world? 30 00:01:49.640 --> 00:01:50.280 Sure thing? 31 00:01:51.000 --> 00:01:55.040 So perhaps the you know, the the boardroom technical language 32 00:01:55.079 --> 00:01:58.799 that we sanitize things with, we say it's adversarial emulation. 33 00:01:59.480 --> 00:02:01.200 Or if you want to sound cool, just at a 34 00:02:01.239 --> 00:02:03.400 cocktail party with your friends. My wife just says, I'm 35 00:02:03.400 --> 00:02:07.760 professionally dangerous. The movie style reference that you make. If 36 00:02:08.120 --> 00:02:09.719 some of the folk of the audiences are old enough 37 00:02:09.719 --> 00:02:12.759 to remember a film in the early nineties, Robert Redford, 38 00:02:12.840 --> 00:02:16.719 dan akro David Strether and another's city Poier Lake River, Phoenix. 39 00:02:16.759 --> 00:02:20.159 It was called Sneakers. That's one of the best illustrations. 40 00:02:20.159 --> 00:02:22.360 In fact, I know the technical advice on that film. 41 00:02:23.560 --> 00:02:24.319 Who's in the trades? 42 00:02:24.400 --> 00:02:24.560 Right? 43 00:02:25.000 --> 00:02:27.960 That is what we do. We break into places so 44 00:02:28.000 --> 00:02:30.800 that people can find out how secure their place is. 45 00:02:31.400 --> 00:02:34.199 We pick the locks, we bypassed the alarms, we mess 46 00:02:34.240 --> 00:02:37.199 with all the access control systems. Case sometimes I'm cracking 47 00:02:37.319 --> 00:02:41.159 safes and the customer gets to find out could a 48 00:02:41.199 --> 00:02:45.599 bad guy with a given sort of threat profile, get in, 49 00:02:45.800 --> 00:02:49.120 get out, possibly do so unnoticed, and then we can 50 00:02:49.199 --> 00:02:51.800 help advise them or their colleagues and their contacts of 51 00:02:51.879 --> 00:02:54.159 what mitigation steps they might want to take to change 52 00:02:54.360 --> 00:02:57.000 to change how robust their security is now. 53 00:02:57.159 --> 00:03:02.000 Is it always mission and pop coming down from the 54 00:03:02.039 --> 00:03:07.120 skylight or do sometimes? You know? And I'm as asking 55 00:03:07.120 --> 00:03:09.759 because I know because I've seen your videos and if 56 00:03:09.759 --> 00:03:12.000 you guys have not checked out any of his videos 57 00:03:12.039 --> 00:03:14.960 on YouTube, you owe it to yourself. They're all fascinating. 58 00:03:15.240 --> 00:03:18.360 But sometimes as it is easy as picking up a clipboard. 59 00:03:20.360 --> 00:03:21.560 Yeah, I mean it is. 60 00:03:21.800 --> 00:03:24.400 You like to fantasize and say that we're all wearing 61 00:03:24.439 --> 00:03:26.360 the you know, the black and you have the tactical 62 00:03:26.439 --> 00:03:27.560 rope gear and your climate. 63 00:03:27.599 --> 00:03:31.039 But yeah, it's sometimes it's one step above knock knock, 64 00:03:31.080 --> 00:03:34.879 knock a password inspector, you know, sometimes you just show up. 65 00:03:34.879 --> 00:03:37.560 When you think about though, I actually think that's not 66 00:03:37.639 --> 00:03:40.280 a bad thing. I think it's representative of how trusting 67 00:03:40.520 --> 00:03:44.319 and safe much of our world is. A lot of 68 00:03:44.360 --> 00:03:48.439 people don't have a high that they live under. Alleople, 69 00:03:48.479 --> 00:03:51.680 if she shows up and they have to stay the 70 00:03:51.719 --> 00:03:54.719 affilicking clip or they've got some paperwork from the local. 71 00:03:54.479 --> 00:03:57.520 Media, Pappy, and they say, hey, yeah, we're the meter 72 00:03:57.639 --> 00:04:01.759 readings today. Who's your facilities director? Oh he's out at lunch. 73 00:04:01.800 --> 00:04:04.080 Well yeah, he usually just gives me a key. A 74 00:04:04.080 --> 00:04:07.199 lot of people working at a front desk if nothing 75 00:04:07.240 --> 00:04:08.360 gets there ackled up. 76 00:04:09.080 --> 00:04:11.039 Oh well that's that makes sense to me. This person 77 00:04:11.039 --> 00:04:14.280 doesn't seem like they're behaving like a threat. Yeah, the 78 00:04:14.360 --> 00:04:16.720 water meter back there in the utility closet. You need 79 00:04:16.720 --> 00:04:18.920 to show you the way. That's a lot of things 80 00:04:19.000 --> 00:04:21.600 just get done in our world. And if you've ever, 81 00:04:21.720 --> 00:04:25.040 for example, had a hotel and maybe the room wasn't 82 00:04:25.120 --> 00:04:27.800 under your name, you're staying with a colleague or a spouse, 83 00:04:28.439 --> 00:04:30.319 and you say, oh, I left something in the room, 84 00:04:31.079 --> 00:04:34.439 most hotels shouldn't give you a key without verifying with 85 00:04:34.480 --> 00:04:36.360 your name's not on the room. But there's plenty of 86 00:04:36.399 --> 00:04:39.000 places out there where if you're not behaving squirrely, and 87 00:04:39.040 --> 00:04:40.839 you can say, yeah, you know who was at the 88 00:04:40.839 --> 00:04:41.480 desk earlier. 89 00:04:41.519 --> 00:04:43.759 It was a blonde girl, right, it was Judy. Yeah, 90 00:04:43.800 --> 00:04:45.879 she was checking us like, well, you know, Judy, you 91 00:04:45.879 --> 00:04:46.279 were here. 92 00:04:46.639 --> 00:04:48.519 You don't look like you're a methad about to steal 93 00:04:48.519 --> 00:04:50.879 the television. Yeah, what room did you need again? 94 00:04:51.120 --> 00:04:51.720 Boom? 95 00:04:51.879 --> 00:04:54.360 Our world has a lot of places where we reduce 96 00:04:54.439 --> 00:04:57.759 friction by doing a quick mental calculus and saying, yeah, 97 00:04:57.800 --> 00:04:59.680 that this person, you know, kind of that that Gavin 98 00:04:59.680 --> 00:05:00.720 de beck a gift of fear. 99 00:05:00.759 --> 00:05:02.920 You're not the hairs in your neck aren't rising. 100 00:05:03.600 --> 00:05:06.240 So much of what we do is, as you describe, 101 00:05:06.360 --> 00:05:09.279 just look like we belong there, have a cover story 102 00:05:09.279 --> 00:05:11.079 that's plausible, and that'll do it. 103 00:05:11.120 --> 00:05:12.959 Sometimes you don't have to break out the special high 104 00:05:12.959 --> 00:05:13.560 tech tools. 105 00:05:14.000 --> 00:05:18.240 Yeah, so let's roll back and start from the beginning. 106 00:05:18.480 --> 00:05:21.439 We always like to ask our guests their origin story, 107 00:05:21.759 --> 00:05:26.120 like how did you get your superpowers? Or TV? So 108 00:05:26.519 --> 00:05:30.600 you you know, you're in a very unique world, you know, 109 00:05:30.759 --> 00:05:34.920 and this isn't you know. Usually we think of people 110 00:05:35.480 --> 00:05:38.600 who are in this world either got there by way 111 00:05:38.800 --> 00:05:42.439 of being with the government or against it. Right, either 112 00:05:43.160 --> 00:05:46.600 you know, a criminal or or you know some sort 113 00:05:46.639 --> 00:05:50.040 of you know, be any section of law enforcement or 114 00:05:50.079 --> 00:05:53.240 intelligence or whatever. How did you grow up and what 115 00:05:53.319 --> 00:05:54.000 led you into this? 116 00:05:57.000 --> 00:05:59.800 Yeah, the the tongue in cheek answer that we like 117 00:05:59.800 --> 00:06:01.360 to s sometimes says that I had some of the 118 00:06:01.399 --> 00:06:02.920 right friends and some of the wrong friends. 119 00:06:03.759 --> 00:06:06.439 And the more broad answer is. 120 00:06:06.399 --> 00:06:09.680 That I had a healthy curiosity about the world around me. 121 00:06:10.040 --> 00:06:11.920 I didn't take a lot of things at face value. 122 00:06:12.000 --> 00:06:14.439 I was raised to question a lot of things by 123 00:06:14.519 --> 00:06:18.279 my loving and kind parents. And when you have that 124 00:06:18.360 --> 00:06:21.519 kind of mental disposition, and you're fortunate enough to grow 125 00:06:21.600 --> 00:06:23.839 up in an environment where I don't know if kids 126 00:06:23.839 --> 00:06:25.439 today could could grow up the way I did. 127 00:06:25.519 --> 00:06:28.079 You know, people our age, your age, my age, like, we. 128 00:06:28.519 --> 00:06:30.519 Snuck around, We got into place so we shouldn't have been, 129 00:06:31.079 --> 00:06:34.560 And there weren't just people ready to call the cops 130 00:06:34.600 --> 00:06:37.600 the instant they saw a teenager, you know, in that's 131 00:06:37.680 --> 00:06:38.839 you know what, why is he on that side of 132 00:06:38.839 --> 00:06:39.319 that fence. 133 00:06:39.879 --> 00:06:41.680 We were allowed to kind of explore and it was 134 00:06:42.000 --> 00:06:46.000 lower stakes and doing so, you yeah, you kind of 135 00:06:46.079 --> 00:06:48.160 learned how you could get in and out of abandoned 136 00:06:48.199 --> 00:06:49.759 buildings and things like that. 137 00:06:51.120 --> 00:06:54.879 And having that knowledge it never really left me. It 138 00:06:54.920 --> 00:06:56.439 never went away. It was always in the back of 139 00:06:56.439 --> 00:06:59.079 my mind. If I was staying at a hotel as 140 00:06:59.120 --> 00:07:02.279 a teenager, or you know, in my twenties, I was 141 00:07:02.279 --> 00:07:04.959 always trying to well, which doors go to the back 142 00:07:04.959 --> 00:07:06.920 of house, which go to the maintenance spaces? 143 00:07:07.000 --> 00:07:09.199 I went oh, oh, there's pipes, there's a generator. This 144 00:07:09.199 --> 00:07:11.199 is I'm not supposed to be here. And then you 145 00:07:11.240 --> 00:07:13.360 get a little bit older and you're staying in hotels 146 00:07:13.439 --> 00:07:15.160 or visiting big buildings. You say, I wonder if I 147 00:07:15.160 --> 00:07:15.920 can get on the roof. 148 00:07:16.160 --> 00:07:18.079 I wonder if I can get into, you know, something 149 00:07:18.120 --> 00:07:21.199 that's more critical infrastructure, and you start to realize that 150 00:07:21.240 --> 00:07:24.040 a lot of the systems that control our world, especially 151 00:07:24.120 --> 00:07:27.879 access control systems, rely on things like doors that swing 152 00:07:27.959 --> 00:07:31.199 shut and click properly, and they often don't, or you 153 00:07:31.279 --> 00:07:33.639 rely on things like, well, no one would want to 154 00:07:33.639 --> 00:07:35.639 go back there because you know, why would you ever 155 00:07:35.680 --> 00:07:37.959 do There's no sign on the door saying it's valuable. 156 00:07:37.959 --> 00:07:39.160 Who would ever check that door? 157 00:07:39.480 --> 00:07:41.439 And you start being the person who checks all the doors, 158 00:07:42.120 --> 00:07:44.040 and then eventually you say, wow, I can get in 159 00:07:44.079 --> 00:07:47.600 a lot of places that our world things you can't 160 00:07:47.600 --> 00:07:50.079 get into. I wonder if I could ever do anything 161 00:07:50.120 --> 00:07:53.160 with this, And I'm fortunate enough that I actually got to. 162 00:07:53.360 --> 00:07:56.639 It's not an easy career to find yourself in. It's 163 00:07:56.639 --> 00:07:59.480 what a lot of people turn to us for kind 164 00:07:59.480 --> 00:08:03.160 of a fish training, which nowadays training is two things. 165 00:08:03.160 --> 00:08:06.240 A lot of people like to say training and certifications. 166 00:08:06.720 --> 00:08:09.399 You know what's the value in that, And it's twofold. 167 00:08:09.399 --> 00:08:12.360 One is learning skills, but also just kind of getting 168 00:08:12.360 --> 00:08:14.120 that official blessing that. 169 00:08:14.160 --> 00:08:17.000 Says, well, I'm not just some chump. I'm not just. 170 00:08:17.240 --> 00:08:20.720 Somebody who's a criminal. I've actually tried to better myself. 171 00:08:20.759 --> 00:08:24.279 I've done some of this professionally. Is if you want 172 00:08:24.279 --> 00:08:26.839 to become a bouncer, maybe you're a guy who's just 173 00:08:26.920 --> 00:08:29.399 good at fistfighting, but maybe if you actually went to 174 00:08:29.439 --> 00:08:31.319 a training course, they say, oh, all right, the training 175 00:08:31.399 --> 00:08:33.759 isn't just me. Anybody could hit somebody. You actually can 176 00:08:33.840 --> 00:08:35.759 keep your head about you. You can do things with 177 00:08:35.840 --> 00:08:38.879 best practices. You understand the professional way to go about 178 00:08:39.120 --> 00:08:41.399 what otherwise would be a very blunt sort of trade. 179 00:08:42.399 --> 00:08:44.480 And that's why, Yeah, people come to us all the 180 00:08:44.480 --> 00:08:47.200 time at Red Team Alliance because they say, I want 181 00:08:47.200 --> 00:08:48.240 to do what you do, but I want to do 182 00:08:48.279 --> 00:08:51.320 it properly. And a lot of people have the knack, 183 00:08:51.720 --> 00:08:54.320 or at least the desire to get in places they 184 00:08:54.360 --> 00:08:56.639 shouldn't be, But can you do it in a way 185 00:08:56.679 --> 00:08:59.679 that is respectful and responsible and adds value to the 186 00:08:59.720 --> 00:09:01.720 claw clients who are paying you to do it? 187 00:09:01.879 --> 00:09:05.320 That's that's a different the street criminal. 188 00:09:06.639 --> 00:09:09.879 You know, it's interesting too because you know, like I said, 189 00:09:09.919 --> 00:09:12.799 you are analog in a digital world in this sense 190 00:09:12.919 --> 00:09:16.480 of you're a hacker. You know, you're uh, you know, 191 00:09:16.600 --> 00:09:19.639 a feature at doufcon and at all the you know, 192 00:09:19.720 --> 00:09:24.159 different hacking conventions, and your path was it seems to 193 00:09:24.200 --> 00:09:26.320 me that it was probably very parallel to a lot 194 00:09:26.360 --> 00:09:29.639 of how the OG hackers grew up, where they were 195 00:09:29.639 --> 00:09:35.200 doing things that you know, weren't probably just because there 196 00:09:35.200 --> 00:09:38.000 weren't you know that you didn't have training facilities, you 197 00:09:38.000 --> 00:09:40.480 didn't have Hacked the Box, you didn't have these things. 198 00:09:40.759 --> 00:09:45.159 People just learned it by doing it, and and so 199 00:09:45.399 --> 00:09:48.559 you were. You were on that exact same path, only 200 00:09:48.600 --> 00:09:54.639 where they were breaking into systems, you were breaking into buildings. 201 00:09:54.919 --> 00:09:56.639 Yeah, that's absolutely the case. 202 00:09:56.960 --> 00:10:00.440 And I'm very as I say, I'm very concerned that 203 00:10:00.519 --> 00:10:03.240 we don't give a lot of younger minds these days 204 00:10:03.279 --> 00:10:05.440 the space and the room to run. I like that 205 00:10:05.480 --> 00:10:07.519 you called out things like hack the Box and so forth. 206 00:10:07.559 --> 00:10:10.960 Those those resources and those assets are really important now 207 00:10:11.480 --> 00:10:14.120 because we don't live in a world that is as 208 00:10:14.200 --> 00:10:17.639 forgiving as it once was. Right, and these minds need 209 00:10:17.679 --> 00:10:21.200 a place to grow and experience these challenges and try 210 00:10:21.240 --> 00:10:24.039 out their skills in real world sort of sort of 211 00:10:24.080 --> 00:10:25.120 play environments. 212 00:10:25.600 --> 00:10:27.279 Otherwise, if all you're doing. 213 00:10:27.200 --> 00:10:30.679 Is prepackaged, you know, kind of buy the book lessons, 214 00:10:31.080 --> 00:10:33.799 are you really learning how things work out there. 215 00:10:33.480 --> 00:10:34.679 On a job? Right? 216 00:10:35.399 --> 00:10:35.519 So? 217 00:10:35.799 --> 00:10:36.200 How? 218 00:10:36.879 --> 00:10:40.120 Because I have to know how did you make that transition? 219 00:10:40.240 --> 00:10:44.000 Because where with the digital side and with hackers, we 220 00:10:44.080 --> 00:10:47.919 see you know the development of software companies and software 221 00:10:48.039 --> 00:10:51.000 and you know the and then you know countermeasures you 222 00:10:51.039 --> 00:10:55.200 know to hackers and stuff like that. But for you, 223 00:10:56.000 --> 00:10:59.600 how did you plant a flag and say hey, I 224 00:10:59.639 --> 00:11:03.720 can break into a building? Anybody want that? 225 00:11:07.279 --> 00:11:08.360 All the credit there? 226 00:11:08.799 --> 00:11:11.799 I think I would keep on a longtime friend of 227 00:11:11.799 --> 00:11:14.559 mine who's in town because we're in town for black 228 00:11:14.559 --> 00:11:18.080 Hat and Defcon. Of course, so my buddy Jeff the 229 00:11:18.120 --> 00:11:20.559 Dark Tangent, who started def Con and with it black 230 00:11:20.559 --> 00:11:23.639 Hat some years after def Con was around the black 231 00:11:23.639 --> 00:11:26.559 Hat conference, which I don't know if all your listeners 232 00:11:26.600 --> 00:11:29.320 know the full origins, I'll give you the real quick story. 233 00:11:29.360 --> 00:11:30.960 It's a brilliant hack of its own type. 234 00:11:31.320 --> 00:11:33.639 The origins of black Hat, the conference and trade show 235 00:11:34.480 --> 00:11:37.080 def Con, which originally started as just kind of a 236 00:11:37.120 --> 00:11:39.960 going away party for Jeff's bulletin board that he was running. 237 00:11:40.919 --> 00:11:43.200 People said, oh, man, this is so cool. 238 00:11:43.240 --> 00:11:44.960 I came out to Vegas and you had this big 239 00:11:45.000 --> 00:11:47.279 party and there were these talks are you going to 240 00:11:47.360 --> 00:11:49.840 do this again? You got to do this next year? 241 00:11:49.879 --> 00:11:52.200 This was great and he's I wasn't playing on anything 242 00:11:52.240 --> 00:11:54.440 like that. I just kind of threw something together from 243 00:11:54.440 --> 00:11:54.919 my friends. 244 00:11:55.279 --> 00:11:56.039 If you want to, we'll do it. 245 00:11:56.120 --> 00:11:57.840 So then def Con happened next year, and def Con 246 00:11:57.879 --> 00:12:00.320 happened the year after that, and Defcon the con friends 247 00:12:00.399 --> 00:12:03.320 kept growing and people were coming up to Jeff in 248 00:12:03.360 --> 00:12:05.799 the hacker world and saying, man, oh, you're a dark tangent. 249 00:12:05.840 --> 00:12:07.960 You run that deaf Con thing. That's so cool, man. 250 00:12:08.240 --> 00:12:11.279 I wish I could go to that. And he would say, then, 251 00:12:11.600 --> 00:12:14.320 then do it. It's a fifty dollars conference. Why don't 252 00:12:14.360 --> 00:12:16.960 you just come? He said, no, my company would never 253 00:12:16.960 --> 00:12:17.519 send me that. 254 00:12:18.440 --> 00:12:18.759 Why. 255 00:12:18.919 --> 00:12:20.120 He's like, well, you know, like you said, it's a 256 00:12:20.120 --> 00:12:23.240 fifty dollars conference. It's not professional. It's you know, it's 257 00:12:23.279 --> 00:12:25.480 not My boss would laugh me out of the room. 258 00:12:25.879 --> 00:12:27.919 And Jeff looked at these people and he said, you're 259 00:12:27.960 --> 00:12:31.320 telling me that I'm running an event that is accessible, 260 00:12:31.919 --> 00:12:34.919 has great content, has great speakers, has all the information 261 00:12:34.960 --> 00:12:37.480 you need, and you can't come because it's too cheap. 262 00:12:38.279 --> 00:12:41.679 And they said basically, yeah, So the very first year 263 00:12:41.679 --> 00:12:44.759 that black Cats started, and Jeff would tell the story 264 00:12:44.799 --> 00:12:48.519 with a little more detail, but effectively, he reached out 265 00:12:48.559 --> 00:12:51.000 to his most popular speakers, the ones who were already. 266 00:12:50.679 --> 00:12:54.159 Coming to Deafcon, and he said, Hey, do me a favor. 267 00:12:54.759 --> 00:12:57.080 I want you to come into town almost a week early, 268 00:12:57.639 --> 00:13:00.480 and I want to put you up at the Caesars 269 00:13:00.960 --> 00:13:01.519 and I want. 270 00:13:01.399 --> 00:13:03.440 You to give the same talks you're gonna give it 271 00:13:03.519 --> 00:13:05.159 at def Con. Give them a few. 272 00:13:05.039 --> 00:13:08.080 Days early to like Feds and suit wearing people and stuff, 273 00:13:08.480 --> 00:13:10.320 and we're going to charge twelve hundred dollars at the door. 274 00:13:10.360 --> 00:13:13.080 We're going to call it black Hat. And everyone thought 275 00:13:13.120 --> 00:13:13.639 that was nuts. 276 00:13:13.799 --> 00:13:16.559 And all those companies that people their bosses wouldn't let 277 00:13:16.600 --> 00:13:18.799 them come to def Con. They said, now this is thing, 278 00:13:18.840 --> 00:13:20.759 the black Cat thing. You bring me this pamphlet, this 279 00:13:20.799 --> 00:13:22.480 is what you should be going to thanks. This is 280 00:13:22.559 --> 00:13:24.679 serious business, right and you know it's the same. It 281 00:13:24.679 --> 00:13:27.679 was the same thing for the first few years, and 282 00:13:27.720 --> 00:13:31.759 then of course black Hat developed professional trainings, multi day trainings, 283 00:13:32.919 --> 00:13:34.679 and I've been going to def Con and black Hat 284 00:13:34.919 --> 00:13:35.360 for ages. 285 00:13:35.399 --> 00:13:38.039 Now I've been going to sayce Defcon eight and good lord, 286 00:13:38.080 --> 00:13:41.799 it's what is it, def Con thirty three thirty four? 287 00:13:41.919 --> 00:13:45.360 Oh my good lord. But when the trainings were starting, 288 00:13:45.440 --> 00:13:47.600 you know, people just hey, you're. 289 00:13:47.440 --> 00:13:49.039 Good at this thing. You should run a training. It 290 00:13:49.080 --> 00:13:52.960 wasn't these full on massive training works. And Jeff approached me. 291 00:13:53.240 --> 00:13:56.240 Tangent said, hey, man, you've been given lock picking talks 292 00:13:56.240 --> 00:13:58.480 at def Con. People love that lock pick stuff you do. 293 00:13:58.960 --> 00:14:01.320 You know you should run a training, black Hat And 294 00:14:01.360 --> 00:14:02.879 I was like, get the hell out of here. No 295 00:14:02.919 --> 00:14:05.480 one's going to come learn lock picking from me for 296 00:14:05.519 --> 00:14:08.279 two days. That's insane. I just do it for free 297 00:14:08.279 --> 00:14:08.960 at Defcongus. 298 00:14:09.000 --> 00:14:09.360 I love it. 299 00:14:09.799 --> 00:14:11.559 And he said, no, you should do it, man, We're 300 00:14:11.559 --> 00:14:13.679 going to pack that room. And that was my first 301 00:14:13.679 --> 00:14:16.600 professional training that I gave. This is long before Red 302 00:14:16.639 --> 00:14:19.120 Team Alliance or anything that existed. It was just me 303 00:14:19.480 --> 00:14:22.000 and my buddy Bobbic in a room and sure enough 304 00:14:22.080 --> 00:14:24.440 we were teaching people the basics. 305 00:14:24.639 --> 00:14:26.720 And next year they said, oh, you should electronics. You 306 00:14:26.759 --> 00:14:27.600 u talk about alarms. 307 00:14:27.600 --> 00:14:29.200 She used to talk about this, and we just kept 308 00:14:29.240 --> 00:14:35.279 adding content, and as often happens at Black Hat, many 309 00:14:35.360 --> 00:14:38.200 times people will take a whole training and they'll say, 310 00:14:38.480 --> 00:14:39.600 this is great stuff. 311 00:14:39.799 --> 00:14:42.240 I learned a lot. Can I hire you to do this? 312 00:14:43.200 --> 00:14:44.320 And you look at them at the end of two 313 00:14:44.360 --> 00:14:46.320 days and you say, you just paid to learn how 314 00:14:46.360 --> 00:14:48.200 to do it though, and they said, yeah, but my 315 00:14:48.279 --> 00:14:51.519 company wouldn't believe me. I'm internal if I report all 316 00:14:51.559 --> 00:14:54.159 these findings that we really need an external voice to 317 00:14:54.240 --> 00:14:55.519 validate all these findings. 318 00:14:55.600 --> 00:14:58.559 Can we just hire you guys? It's like money can 319 00:14:58.600 --> 00:15:00.679 be exchanged for goods and services. I don't mind having 320 00:15:00.679 --> 00:15:01.320 no money. Sure. 321 00:15:01.759 --> 00:15:03.799 So that's where some of our earliest clients came from. 322 00:15:03.879 --> 00:15:05.799 They were the people we were training at Black Cat 323 00:15:06.080 --> 00:15:08.039 who were then immediately a month later hiring us to 324 00:15:08.039 --> 00:15:11.080 come break into their buildings, and then word of mouth spread. 325 00:15:11.080 --> 00:15:13.399 We've never done any real marketing of any kind. 326 00:15:14.039 --> 00:15:15.519 It's just people. Oh, those are the guys who do 327 00:15:15.559 --> 00:15:18.120 that stuff. Yeah, I've heard of that that you should. 328 00:15:17.840 --> 00:15:19.919 Take their training, you should hire them, did that thing, 329 00:15:19.960 --> 00:15:21.679 And that's that's how I got my career. 330 00:15:22.519 --> 00:15:25.279 Well, you know, now, I guess when you know we 331 00:15:25.320 --> 00:15:28.720 think of red teaming and you know, getting access to 332 00:15:28.759 --> 00:15:33.039 internal you know systems and whatnot, like the physical red 333 00:15:33.039 --> 00:15:35.559 teaming and the physical pen testing. You know, we think 334 00:15:35.600 --> 00:15:39.159 of that. But how did you you know, before the Internet, 335 00:15:39.240 --> 00:15:42.399 before all this, you know, was it twenty six how 336 00:15:42.440 --> 00:15:45.399 did you find yourself in the you know, with this 337 00:15:45.440 --> 00:15:48.360 set of skills in the hacker community. 338 00:15:50.960 --> 00:15:52.519 Yeah, so you mentioned briefly. 339 00:15:52.679 --> 00:15:54.679 I hired a little passing reference to twenty six hundred, 340 00:15:54.720 --> 00:15:56.480 the magazine, the twenty six hundred meetups. 341 00:15:57.000 --> 00:15:58.600 I was part of the twenty six hundred crew. 342 00:15:58.639 --> 00:16:01.679 Back easton Philly where I was living, there was a 343 00:16:01.879 --> 00:16:03.960 non pro well now is a nonprofit. At the time, 344 00:16:04.000 --> 00:16:06.840 it was just kind of a ragtag group of enthusiasts. 345 00:16:07.440 --> 00:16:10.360 There's this group called TOOL, the Open Organization of Lock Pickers. 346 00:16:10.879 --> 00:16:12.759 That is a group that still exists to this day. 347 00:16:12.840 --> 00:16:15.200 I was on their board of directors as a nonprofit 348 00:16:15.240 --> 00:16:18.320 board member for a very long time. But it was 349 00:16:18.360 --> 00:16:22.360 people just kind of had a passing enemprist. Or you 350 00:16:22.360 --> 00:16:25.240 would be at a tech even a professional tech event, 351 00:16:25.639 --> 00:16:28.200 you might see somebody picking locks just as a hobby, 352 00:16:28.600 --> 00:16:31.600 much in the way that you'll see people nowadays cross 353 00:16:31.600 --> 00:16:34.120 stitching or doing crochet. If they're on a long plane 354 00:16:34.120 --> 00:16:37.120 flight or sitting in a long lecture in an academic setting, 355 00:16:37.480 --> 00:16:41.639 you'd see locks being picked in the hacker world, and 356 00:16:41.679 --> 00:16:43.879 for some people that never went anywhere beyond being a 357 00:16:43.879 --> 00:16:46.399 hobby and for some of us became a real obsession. 358 00:16:46.960 --> 00:16:50.320 But yeah, the hobbyist community and that the hacker mindset 359 00:16:50.360 --> 00:16:53.360 of these are some cool skills. I just want to 360 00:16:53.480 --> 00:16:57.759 use them for fun. Fun can become profitable. 361 00:16:58.360 --> 00:17:01.360 I would like to thank a sponsor tonight, somebody I'm 362 00:17:01.519 --> 00:17:04.200 actually I've never heard of, but I'm super excited about 363 00:17:04.279 --> 00:17:05.799 right now. You see, I have to put on my 364 00:17:05.799 --> 00:17:10.240 reading glasses of getting old and with that age and 365 00:17:10.279 --> 00:17:13.000 the abuse that Jack and I have been through through 366 00:17:13.039 --> 00:17:17.279 the years, the arthritis, the sleep at NEEA, the insomnia. 367 00:17:17.960 --> 00:17:20.640 You know, this amounts of scotch, Yes, copious amounts of scotch. 368 00:17:21.000 --> 00:17:23.319 You know, we had Chris free On just a short 369 00:17:23.319 --> 00:17:25.599 while ago and he talked about the operator syndrome, right, 370 00:17:25.680 --> 00:17:28.720 and you know we have TVIS and blast exposure and 371 00:17:28.759 --> 00:17:31.559 post traumatic stress and all these things going on for 372 00:17:31.680 --> 00:17:34.160 us and and not just us, but everybody. You're all, 373 00:17:34.319 --> 00:17:36.799 you know, subjected to all this stuff. So our new 374 00:17:36.839 --> 00:17:41.759 sponsor is superpower dot Com. And the reason I'm really 375 00:17:41.759 --> 00:17:46.200 excited about Superpower dot Com is a lot of things 376 00:17:46.200 --> 00:17:49.559 that Chris was talking about, a lot of the processes 377 00:17:49.640 --> 00:17:51.519 that are going on in our bodies that we don't 378 00:17:51.559 --> 00:17:54.400 know about, and that like your normal doctor isn't even 379 00:17:54.400 --> 00:17:57.720 gonna know to check their checking this stuff. It's a 380 00:17:57.799 --> 00:17:59.279 concierge medical service. 381 00:17:59.839 --> 00:17:59.920 Uh. 382 00:18:00.160 --> 00:18:01.880 You know, we've all been there. You go to the doctor, 383 00:18:01.960 --> 00:18:04.119 get your blood drawn, and a week later you hear 384 00:18:04.559 --> 00:18:06.799 everything looks fine, And a lot of times you got 385 00:18:06.799 --> 00:18:08.680 to pull teeth just to get them to do a 386 00:18:08.720 --> 00:18:13.240 basic panel. Right. Maybe they tell you to drink more 387 00:18:13.279 --> 00:18:17.000 water or exercise more, but that's it. No breakdown of 388 00:18:17.039 --> 00:18:22.160 your hormones, no insight to the inflammation, toxins, the nutrient deficiencies, 389 00:18:22.519 --> 00:18:26.119 just vague advice and a pat on the back. Superpower 390 00:18:26.160 --> 00:18:30.279 Health is a completely different experience. It's a revolutionary new 391 00:18:30.359 --> 00:18:34.759 kind of preventative care, more comprehensive, more actual, and you 392 00:18:34.759 --> 00:18:37.039 can do it all from the comfort of your own home. 393 00:18:37.880 --> 00:18:41.839 Here's how it works. Twice a year, Superpower sends a 394 00:18:41.920 --> 00:18:46.400 licensed professional right to your door to collect a comprehensive 395 00:18:46.480 --> 00:18:50.279 lab panel, or you can visit a nearby lab. Super 396 00:18:50.559 --> 00:18:54.960 Power measures over one hundred biomarkers. That includes your heart, 397 00:18:55.279 --> 00:18:59.680 your liver, your thioid, your hormones, your metabolism, your vitamin 398 00:18:59.720 --> 00:19:02.119 and in your mineral levels. I mean that is like 399 00:19:02.279 --> 00:19:05.440 everything that Chris was talking about, right, and again, a 400 00:19:05.480 --> 00:19:07.039 lot of you may not have been in the military 401 00:19:07.079 --> 00:19:09.319 and may not have had special ops, may not been combat. 402 00:19:09.480 --> 00:19:13.640 It doesn't matter. Like these stressors, they affect all of us, 403 00:19:13.720 --> 00:19:17.680 you know, and you know it's just this is amazing 404 00:19:17.720 --> 00:19:20.920 to me. I just cannot wait to get started with this. 405 00:19:22.839 --> 00:19:25.799 Then you get a personalized action plan based on your results, 406 00:19:25.839 --> 00:19:29.359 all beautifully laid out in their app, plus access to 407 00:19:29.400 --> 00:19:32.960 your own private medical team to help guide you. It's 408 00:19:33.000 --> 00:19:36.000 the same level of testing and insight the pro athletes get, 409 00:19:36.200 --> 00:19:39.799 but at a price that actually makes sense. Stop hoping 410 00:19:39.839 --> 00:19:43.720 you'll live a long, healthy life, start taking action. For 411 00:19:43.799 --> 00:19:47.519 a limited time, our listeners get fifty dollars off when 412 00:19:47.519 --> 00:19:53.119 they use Code Team. That's Team Code Team at superpower 413 00:19:53.200 --> 00:19:57.440 dot com. The superpower not only gives you an initial plan, 414 00:19:57.759 --> 00:20:01.440 but it attracts your results over your lifetime. Each test 415 00:20:01.599 --> 00:20:04.200 builds on the last, giving you a full picture of 416 00:20:04.240 --> 00:20:08.400 your progress year after year. So for a limited time, 417 00:20:08.720 --> 00:20:11.720 our listeners are getting fifty dollars off an annual Superpower 418 00:20:11.799 --> 00:20:15.839 membership by using code Team at checkout. Just head to 419 00:20:15.920 --> 00:20:21.079 superpower dot com and use code team that's team to 420 00:20:21.119 --> 00:20:25.640 get our exclusive discount, your biology decoded, your blueprint activated 421 00:20:25.680 --> 00:20:29.559 with Superpower. After you approach, after you purchase, they will 422 00:20:29.599 --> 00:20:33.119 ask you where you heard about them. Please please support 423 00:20:33.160 --> 00:20:36.839 our show and tell them our show sent you. Like 424 00:20:36.839 --> 00:20:40.200 I said, this to me is exciting, like when they 425 00:20:40.240 --> 00:20:42.519 talk about getting all these tests and you know, all 426 00:20:42.519 --> 00:20:43.640 these things, I don't. 427 00:20:43.440 --> 00:20:45.880 Even know where it started, and you have to find 428 00:20:45.920 --> 00:20:47.839 somebody who will actually do it. 429 00:20:48.440 --> 00:20:51.160 You also have no idea, like you know, if you're 430 00:20:51.359 --> 00:20:54.160 having aches and pains or you're feeling tired all the time, 431 00:20:54.279 --> 00:20:56.319 like you don't know what you're deficient in. 432 00:20:56.400 --> 00:20:58.599 It it could be a vitamin, it could it could 433 00:20:58.640 --> 00:21:03.000 be anything, right, yeah, yeah, yeah, So and look, maybe 434 00:21:03.000 --> 00:21:05.400 you're old and broken like I am, or young and 435 00:21:05.480 --> 00:21:09.599 spry like Jack. But it's like it's it's always a 436 00:21:09.599 --> 00:21:11.839 good time to start, you know, either find out what's 437 00:21:11.880 --> 00:21:15.000 going on or to you know, stay young and healthy 438 00:21:15.319 --> 00:21:18.559 for the next forty years. So anyway, check them out 439 00:21:18.599 --> 00:21:23.640 Superpower dot com. Use team to check out thanks. Yeah, 440 00:21:23.799 --> 00:21:29.319 that's fantastic. What was the first like big score for 441 00:21:29.440 --> 00:21:31.440 you where you're like, wow, I can actually do this 442 00:21:31.519 --> 00:21:32.000 for a living. 443 00:21:34.880 --> 00:21:36.319 I'll answer it in two ways. 444 00:21:36.559 --> 00:21:39.960 There was the first time that I sort of unofficially 445 00:21:40.039 --> 00:21:43.200 fell into this work, and then the first really good client. 446 00:21:43.279 --> 00:21:44.559 And I'll sanitize both of them. 447 00:21:44.559 --> 00:21:49.519 Obviously, one was a law firm, and this was just 448 00:21:49.640 --> 00:21:51.200 a local you know, to where I was. 449 00:21:51.160 --> 00:21:52.240 Living near Philadelphia. 450 00:21:52.880 --> 00:21:56.400 They were just outside the city and they essentially had 451 00:21:56.440 --> 00:21:58.799 assists admin there. There guy who was on site. They're 452 00:21:58.839 --> 00:22:00.640 the guy who did all the computers and servers. 453 00:22:00.400 --> 00:22:01.039 In the accounts. 454 00:22:01.599 --> 00:22:03.839 He just kind of rage quit one day, just real 455 00:22:04.119 --> 00:22:05.759 table flip slammed the door. 456 00:22:05.599 --> 00:22:08.319 And people are like, I don't know if he's coming back. 457 00:22:09.039 --> 00:22:12.119 And I was known as a guy who could get 458 00:22:12.160 --> 00:22:14.799 into locked places just word of mouth. People knew me 459 00:22:14.839 --> 00:22:18.559 as that person from the hacker community. And somebody knew 460 00:22:18.640 --> 00:22:21.720 somebody who knew somebody who called me and they said, hey, 461 00:22:22.279 --> 00:22:25.720 we have a situation here at this law office. We 462 00:22:25.880 --> 00:22:28.799 kind of think we should be doing something. We had 463 00:22:28.799 --> 00:22:31.000 this guy leave. We don't know if he has the passwords. 464 00:22:31.400 --> 00:22:35.319 We need to mitigate this situation. And I was consulting 465 00:22:35.519 --> 00:22:37.920 at the time, which means I was between jobs, right right, 466 00:22:38.000 --> 00:22:39.880 And I said, oh, I could make some room in schedule, 467 00:22:39.880 --> 00:22:42.519 and I'm make my way over there. And I didn't 468 00:22:42.519 --> 00:22:45.640 know if they wanted me essentially to do any tech 469 00:22:45.680 --> 00:22:48.200 work or I didn't know exactly what they wanted because 470 00:22:48.240 --> 00:22:50.359 I thought they said, oh, the door's locked, to get 471 00:22:50.400 --> 00:22:50.680 a break. 472 00:22:50.839 --> 00:22:51.920 They didn't expect me to break in. 473 00:22:51.960 --> 00:22:54.319 They expected me to take over the servers, which you know, 474 00:22:54.559 --> 00:22:57.319 I did a lot of network security work too, so 475 00:22:57.400 --> 00:22:59.720 I was there with my copy of nor Dolls and 476 00:22:59.759 --> 00:23:02.519 Ta boots and other things. But as I showed up, 477 00:23:03.279 --> 00:23:05.160 I said, it will sit tight. We got a locksmith 478 00:23:05.200 --> 00:23:06.160 on the way to get you in. As soon as 479 00:23:06.200 --> 00:23:08.400 you get into that office, you can do your thing 480 00:23:08.400 --> 00:23:09.200 that we hired you to do. 481 00:23:09.319 --> 00:23:10.160 And I said okay. 482 00:23:10.200 --> 00:23:12.039 And I sat there and just I don't know what 483 00:23:12.079 --> 00:23:13.960 I was doing in the lobby is pre social media. 484 00:23:14.000 --> 00:23:15.359 I just must have read a magazine. 485 00:23:15.799 --> 00:23:18.079 So I was bored and I said, you know, I'm sorry, 486 00:23:18.119 --> 00:23:21.119 I'm a clock. I've been here a while. Now, can 487 00:23:21.160 --> 00:23:22.799 you show me that what we're we talking about for 488 00:23:22.920 --> 00:23:24.319 the server room here? And they took me down a 489 00:23:24.359 --> 00:23:26.720 hall and I went, oh, it's just an office door. 490 00:23:27.000 --> 00:23:28.960 I'm pretty sure I can bypass that. And sure enough, 491 00:23:29.000 --> 00:23:31.400 you know, kachunk you slip I you know, took the 492 00:23:31.440 --> 00:23:35.200 cover off some TPS report equivalent, slip the cover into 493 00:23:35.240 --> 00:23:35.720 the doorframe. 494 00:23:35.759 --> 00:23:36.519 Door pops open. 495 00:23:37.400 --> 00:23:39.640 I was like, all right, well, canceled the locksmith, and 496 00:23:39.680 --> 00:23:41.759 then I did my thing with all the servers and 497 00:23:41.799 --> 00:23:44.480 I'm rootbooting and I said, okay, well it looks like, yeah, 498 00:23:44.519 --> 00:23:47.039 you don't have any Telnet or SSH running your net 499 00:23:47.079 --> 00:23:50.519 or your mail server. Your web must be hosted elsewhere. Yeah, 500 00:23:50.519 --> 00:23:53.079 this doesn't look too squarely. Have a proper incident management 501 00:23:53.119 --> 00:23:55.160 team come through. But you're you're looking pretty good. I 502 00:23:55.160 --> 00:23:57.359 can change your root passwords. What do you want that 503 00:23:57.400 --> 00:23:59.799 new password to be? And writing it down? They go, yeah, 504 00:24:00.000 --> 00:24:00.759 a new root passport. 505 00:24:00.799 --> 00:24:02.599 Yeah, what did you do to that door? 506 00:24:03.079 --> 00:24:05.519 I was like, oh, yeah, your door latches aren't activating 507 00:24:05.519 --> 00:24:07.480 correctly because you have access control latches. 508 00:24:07.759 --> 00:24:09.559 It's you know, your locksmith could explain that to you. 509 00:24:09.640 --> 00:24:11.599 He said, no, you explain it to me, show us, 510 00:24:11.759 --> 00:24:14.240 show us in this guy's office and he's calling partners over. 511 00:24:14.960 --> 00:24:16.720 So that was the first time that someone said, oh, 512 00:24:16.799 --> 00:24:18.960 you do more than just the ones and zero's you 513 00:24:19.000 --> 00:24:22.440 do that break in thing, and that I was known 514 00:24:22.519 --> 00:24:24.119 just in the local Philly area as a guy who 515 00:24:24.119 --> 00:24:26.960 could do that, and as far as nationwide. One of 516 00:24:26.960 --> 00:24:29.279 our first, as I mentioned, you know, students that we had, 517 00:24:29.759 --> 00:24:31.839 was a crew of students from a we'll just call 518 00:24:31.880 --> 00:24:33.359 them a major tech company. 519 00:24:33.759 --> 00:24:36.039 They make internet appliances and internet. 520 00:24:35.799 --> 00:24:38.680 Services that loads of people have interacted with and they've 521 00:24:38.720 --> 00:24:40.960 been they're in your data centers. They they're a well 522 00:24:40.960 --> 00:24:43.519 known brand. And they were the ones that shocked. They 523 00:24:43.559 --> 00:24:45.279 took us out to dinner. I'd never been to a 524 00:24:45.279 --> 00:24:49.240 fancy Vegas restaurant. I'm some young kid, and I was 525 00:24:49.279 --> 00:24:51.039 shocked when they said, we got to get your infhobiues. 526 00:24:51.079 --> 00:24:51.759 We want to hire you. 527 00:24:51.799 --> 00:24:53.920 And you know, a few weeks after black Hat, they 528 00:24:53.920 --> 00:24:57.400 were hiring us to break into multiple offices around the country. 529 00:24:58.160 --> 00:25:01.000 And you've done this before, right, I broke it into 530 00:25:01.039 --> 00:25:03.240 a car dealership, in a law office in Philadelphia, some 531 00:25:03.279 --> 00:25:04.200 other small time stuff. 532 00:25:04.279 --> 00:25:07.079 Never have anything big like this. Every job you think 533 00:25:07.119 --> 00:25:08.400 you're like, well, this is gonna be the job. 534 00:25:08.880 --> 00:25:11.240 There's gonna be a tough one, and then you realize no, 535 00:25:11.400 --> 00:25:12.960 there's always a way in there's always a way you 536 00:25:12.960 --> 00:25:14.119 can you can break in, you can. 537 00:25:14.039 --> 00:25:16.319 Find a way each and then you just get win 538 00:25:16.400 --> 00:25:17.640 after win after win, and. 539 00:25:17.559 --> 00:25:19.559 Then and you're the guy. We got to hire those guys. 540 00:25:19.960 --> 00:25:23.720 Hire that team again. Nowadays, whenever somebody bids a job, 541 00:25:24.079 --> 00:25:27.039 they tend to reach out. So RTA is our training company, 542 00:25:27.039 --> 00:25:28.960 but the core group is is who you know are 543 00:25:28.960 --> 00:25:32.240 breaking consulting firm. And it's funny we always get told 544 00:25:32.240 --> 00:25:34.960 in these calls, they say, well, yep, we're talking to you, 545 00:25:35.000 --> 00:25:37.680 because everyone we talked to either said hire the core 546 00:25:37.720 --> 00:25:41.799 group or those guys trained us, Like they're either they're 547 00:25:41.839 --> 00:25:43.279 the ones who do it or they're the ones who 548 00:25:43.319 --> 00:25:44.200 train the people who do it. 549 00:25:44.279 --> 00:25:46.480 Just just hire them. So the word of mouth just 550 00:25:46.559 --> 00:25:47.119 keep spreading. 551 00:25:47.480 --> 00:25:49.920 That's fantastic. I would love to ask. 552 00:25:50.160 --> 00:25:52.920 I have to ask, has there ever been a situation 553 00:25:53.000 --> 00:25:55.440 where the bad guys wanted to hire you and like 554 00:25:55.519 --> 00:25:57.880 you're kind of like does a sketch or I need 555 00:25:57.880 --> 00:26:00.559 to take a step back from this one. 556 00:26:00.920 --> 00:26:03.519 You know, for the longest time the answer was no. 557 00:26:05.279 --> 00:26:11.200 And I'll say there have been two occasions when yeah, 558 00:26:11.200 --> 00:26:12.519 you got two stories out of me on this one. 559 00:26:12.519 --> 00:26:16.200 Two occaions were things were a little weird. One was 560 00:26:16.240 --> 00:26:19.160 a job that we wound up not taking. It was 561 00:26:19.240 --> 00:26:21.880 going to be in Taiwan. It was going to be 562 00:26:22.039 --> 00:26:25.359 for a very famous property in Taipei. 563 00:26:26.240 --> 00:26:27.519 It's it's very big. 564 00:26:27.400 --> 00:26:29.680 Famous pictures of it on the internet, where if you're 565 00:26:29.680 --> 00:26:32.759 familiar with what a tuned mass damper is inside of 566 00:26:32.759 --> 00:26:34.920 big buildings, theirs is a gorgeous you can bet you'd 567 00:26:34.920 --> 00:26:36.000 almost walk up and touch it. 568 00:26:36.000 --> 00:26:37.079 It's a very famous building. 569 00:26:37.839 --> 00:26:40.079 And the whole thing was they wanted to you know, 570 00:26:40.160 --> 00:26:42.319 they said, well, here we are, Taiwan is a very 571 00:26:42.319 --> 00:26:45.680 politically sensitive area, and we have a very large neighbor 572 00:26:46.240 --> 00:26:49.759 and we're not sure if they're interested in, you know, 573 00:26:49.799 --> 00:26:53.200 our buildings. And we were never actually one hundred percent 574 00:26:53.240 --> 00:26:57.039 sure if this was people from the Taiwanese authority who 575 00:26:57.039 --> 00:26:58.920 were worried about China, or if this. 576 00:26:59.000 --> 00:27:01.400 Was kind of trying to hire us to do something 577 00:27:01.400 --> 00:27:01.839 in Taiwan. 578 00:27:01.920 --> 00:27:03.599 I mean, I think it was probably all in the 579 00:27:03.680 --> 00:27:05.559 up and up, But the job wound. 580 00:27:05.319 --> 00:27:07.559 Up never coming, you know, kind of coming to fruition. 581 00:27:07.640 --> 00:27:09.440 I said, you know what, that's probably for the best. 582 00:27:09.559 --> 00:27:10.400 I'm fine with that. 583 00:27:11.599 --> 00:27:13.519 The other one was our on the training side at 584 00:27:13.559 --> 00:27:16.880 R ta. We did have a student. This was very recent. 585 00:27:16.920 --> 00:27:19.400 We've never we've never had this come up until very recently. 586 00:27:20.079 --> 00:27:22.079 We've had a student in one of our access control 587 00:27:22.160 --> 00:27:25.799 classes where I mean, if you don't even the show notes, 588 00:27:25.799 --> 00:27:28.519 you'll link you see like what our training is very clear. 589 00:27:28.559 --> 00:27:33.119 It's talking about like I class and room keys and badge. 590 00:27:33.200 --> 00:27:35.480 Badge cloning and things like that was one of the things. 591 00:27:35.839 --> 00:27:39.119 And this one person showed up and almost within the 592 00:27:39.119 --> 00:27:40.960 first hour he started. 593 00:27:40.680 --> 00:27:43.079 Asking questions about so is this how credit cards work? 594 00:27:43.839 --> 00:27:45.759 And we're like, well, I mean credit cards, you know, 595 00:27:45.839 --> 00:27:47.839 like tap to pay, I mean they use NFC, the 596 00:27:47.920 --> 00:27:50.480 use near field, I mean, it's like RFID kind of 597 00:27:50.480 --> 00:27:54.720 it is, you know, inductively coupled. But we you know, 598 00:27:54.799 --> 00:27:57.240 we're talking about badge control systems and you don't. You 599 00:27:57.240 --> 00:27:59.839 don't use credit cards to get into your data centers, right, 600 00:28:00.599 --> 00:28:02.119 And he keeps listening and stuff. 601 00:28:02.279 --> 00:28:03.880 No, but when are we going to do the credit 602 00:28:03.880 --> 00:28:06.720 card stuff? You know, ISO ISO fourteen. 603 00:28:06.559 --> 00:28:07.200 Four to four B. 604 00:28:07.880 --> 00:28:10.759 And we're like, well, what did you just like google what? 605 00:28:11.480 --> 00:28:13.480 He was asking questions that made it sound like he 606 00:28:13.559 --> 00:28:17.359 just googled something like card cloning and found us and 607 00:28:17.440 --> 00:28:21.160 it became apparent that he was literally in class because 608 00:28:21.160 --> 00:28:22.720 he thought he was going to learn how to clone 609 00:28:22.720 --> 00:28:26.599 credit cards, and everyone around him, there was a mix 610 00:28:26.640 --> 00:28:28.839 of like Feds and other people in the room like 611 00:28:29.720 --> 00:28:31.839 over at him, and he said, it's like the guy 612 00:28:31.839 --> 00:28:34.240 who walks into the head shop and is like, this 613 00:28:34.359 --> 00:28:37.119 glass pipe is for the marijuana's right right? 614 00:28:37.240 --> 00:28:39.400 You know, Yeah, I was gonna I was gonna say, 615 00:28:39.400 --> 00:28:41.920 it sounds like it sounds like the nine to eleven 616 00:28:42.039 --> 00:28:43.960 hijackers that want to learn how to fly, but not 617 00:28:44.000 --> 00:28:44.960 way in the airplane. 618 00:28:45.000 --> 00:28:49.079 You're kind of like, uh right, yeah. 619 00:28:49.279 --> 00:28:52.960 And eventually we talked to him during some breaks, and 620 00:28:53.319 --> 00:28:55.960 he sounded like a guy. He didn't sound like he 621 00:28:56.119 --> 00:28:57.880 was a criminal. It sounded like he was trying to 622 00:28:57.960 --> 00:29:00.240 maybe spire and bark on a new career. He just 623 00:29:00.279 --> 00:29:03.720 didn't quite understand why it was. I think he he 624 00:29:03.799 --> 00:29:06.480 told a story to us about how a relative of 625 00:29:06.519 --> 00:29:09.759 his had had a legitimate, like credit card fraud and 626 00:29:09.799 --> 00:29:12.039 how it just got reversed because you know, like you 627 00:29:12.079 --> 00:29:14.319 call your bank and you say I wasn't in Kansas City, 628 00:29:14.440 --> 00:29:17.039 and so he's like, oh, what if you could copy 629 00:29:17.039 --> 00:29:18.680 a credit card and then you could use it in 630 00:29:18.680 --> 00:29:20.480 a bunch of cities and then you claim it was fraud. 631 00:29:20.799 --> 00:29:22.680 It's like free money. He was very young. 632 00:29:22.720 --> 00:29:24.759 He was just a very young person, and young people 633 00:29:24.799 --> 00:29:27.599 are naive. And we said, first of all, no, I 634 00:29:27.640 --> 00:29:30.279 mean that's that is not like a crime. That is 635 00:29:30.319 --> 00:29:30.720 a crime. 636 00:29:30.759 --> 00:29:33.599 You can't do that. Two, we don't do that here. 637 00:29:34.400 --> 00:29:37.000 And three you've just said a lot of things that 638 00:29:37.039 --> 00:29:39.119 are very actionable in front of people. 639 00:29:39.119 --> 00:29:42.240 You should not. You don't. Don't do that, please please, Rea. 640 00:29:42.440 --> 00:29:43.039 And we talked. 641 00:29:43.240 --> 00:29:44.839 We talked to him a lot. Actually the parking lot. 642 00:29:44.880 --> 00:29:46.920 We the second day. We said we're sorry, we were 643 00:29:47.000 --> 00:29:49.359 going to have to we refunded you. We're like, this 644 00:29:49.440 --> 00:29:51.640 is not the class for you. I think you got 645 00:29:51.640 --> 00:29:54.440 the wrong idea. No harm, no foul. 646 00:29:55.240 --> 00:29:56.839 You know, we took it, We took the equipment back 647 00:29:56.880 --> 00:29:57.240 that you know. 648 00:29:57.440 --> 00:30:00.559 The kid, so he listened to a we had to say, 649 00:30:00.559 --> 00:30:02.319 and I think maybe it sent him on a better path. 650 00:30:03.200 --> 00:30:05.039 But that was that was a shocker for me. 651 00:30:05.119 --> 00:30:08.200 How how you could you know, look at our class 652 00:30:08.200 --> 00:30:10.720 description and come away thinking that that's what the class 653 00:30:10.799 --> 00:30:11.200 was about. 654 00:30:11.599 --> 00:30:15.079 And he just didn't know the security world really explained. 655 00:30:15.119 --> 00:30:17.359 He's like, why are all these other people in your class, 656 00:30:18.119 --> 00:30:20.119 and we're like, well, because they're doing it for good, 657 00:30:20.319 --> 00:30:23.000 Like they're doing it to test and work with these 658 00:30:23.000 --> 00:30:24.200 companies to make it better. 659 00:30:24.640 --> 00:30:27.039 Right, he had no idea that could be a career. 660 00:30:27.039 --> 00:30:29.000 He's like, that's so strange. Why would anyone do that? 661 00:30:29.960 --> 00:30:34.880 Yeah, it's fascinating. I mean I wonder, you know, because 662 00:30:34.920 --> 00:30:39.480 classes like yours, same as like tactical shooting classes or whatever, 663 00:30:40.000 --> 00:30:42.559 that there are probably a lot of wannabes out there 664 00:30:42.640 --> 00:30:46.039 right who take the classes and and and really and 665 00:30:46.079 --> 00:30:48.000 I don't mean want to be in an insulting way. 666 00:30:48.039 --> 00:30:51.480 It's just they had this idea of of being, you know, 667 00:30:51.519 --> 00:30:54.119 Johnny high speed. They take the class and never do 668 00:30:54.160 --> 00:30:54.839 anything with it. 669 00:30:56.240 --> 00:30:58.960 Yeah, but yeah, yeah, all the guys who saw john 670 00:30:58.960 --> 00:31:01.039 Wick and wanted to learn Center Access Relock. 671 00:31:00.759 --> 00:31:05.759 Is exactly exactly exactly. I do like Center Actions Relock though. 672 00:31:06.920 --> 00:31:12.079 But so it's interesting that you were like assists admin 673 00:31:12.119 --> 00:31:14.920 and network admin. I you know, in my mind, for 674 00:31:14.960 --> 00:31:17.079 some reason, I thought that maybe, you know, when you 675 00:31:17.119 --> 00:31:18.920 were doing the vanilla stuff, that you were like a 676 00:31:18.960 --> 00:31:20.119 locksmith or something. 677 00:31:22.400 --> 00:31:26.279 So I did get my certifications across the board, but 678 00:31:26.319 --> 00:31:29.559 that sort of came around the other direction later ever since, 679 00:31:29.920 --> 00:31:32.960 I have a rule for myself that every year I 680 00:31:33.000 --> 00:31:36.559 want to take at least one or two trainings of 681 00:31:36.599 --> 00:31:39.920 some kind just to learn, just to always be learning 682 00:31:39.920 --> 00:31:43.160 a new skill. I think you learn not just about 683 00:31:43.279 --> 00:31:45.240 the training that you're in. You learn it even I 684 00:31:45.279 --> 00:31:46.440 just I like teaching. 685 00:31:46.880 --> 00:31:48.920 I am a teacher by trade, right, and I just 686 00:31:49.039 --> 00:31:51.960 learned about teaching by watching other people teach. 687 00:31:52.000 --> 00:31:54.440 And I say, okay, boy, I wouldn't I wouldn't presented 688 00:31:54.480 --> 00:31:57.319 that concept that way. I would to think of it 689 00:31:57.359 --> 00:31:59.119 this way. So but yeah, just learning a new skill 690 00:31:59.200 --> 00:32:01.240 just to keep the brain as elastic as you can. 691 00:32:01.960 --> 00:32:05.960 So over time, I've added many credentials and letters to 692 00:32:06.039 --> 00:32:10.799 my name in this space just because I mean, it's like, 693 00:32:10.920 --> 00:32:12.960 I won't say a vacation for me, but it is 694 00:32:13.160 --> 00:32:16.799 a mental It is definitely a mental pleasure week when 695 00:32:16.799 --> 00:32:21.200 I go down to Lockmasters or Mark Bates Academy or 696 00:32:21.400 --> 00:32:24.880 the Savaga Safetech Conference something like that. These are skills 697 00:32:24.880 --> 00:32:27.000 that I sort of kind of had because I had 698 00:32:27.000 --> 00:32:29.440 self taught myself along the way and I wanted to 699 00:32:29.640 --> 00:32:31.240 all right now I think I know this. Let me 700 00:32:31.240 --> 00:32:34.119 sit in the class. Oh actually no, I didn't know 701 00:32:34.160 --> 00:32:35.680 the last ten percent of it. I didn't know this 702 00:32:35.799 --> 00:32:38.799 other this new tool exists. I learned that ten years ago, 703 00:32:38.799 --> 00:32:41.359 and now there's a new tool. So I'm finding great value. 704 00:32:41.759 --> 00:32:43.400 But at the end of these classes you wind up, 705 00:32:43.519 --> 00:32:45.039 you know, with paper you can hang on the wall, 706 00:32:45.519 --> 00:32:48.240 and then you wind up with actual certifications and accreditations, 707 00:32:48.599 --> 00:32:50.240 and I say, oh, that's pretty cool. So yes, I 708 00:32:50.599 --> 00:32:54.039 am a sav TO certified now certified professional safe Technician. 709 00:32:54.039 --> 00:32:55.200 I passed my CPS. 710 00:32:55.839 --> 00:32:57.640 I have in a lower number as a locksmith, I'm 711 00:32:57.640 --> 00:33:01.279 a forensic locksmith now, oh yeah, people like Tom DeMont 712 00:33:01.319 --> 00:33:04.160 and Drumpee. These these are icons of the forensics world. 713 00:33:04.400 --> 00:33:07.519 They taught me things that you can microscopically look inside 714 00:33:07.519 --> 00:33:10.640 of locks and see techniques and tools that might have 715 00:33:10.680 --> 00:33:13.839 been in there. Technically I could testify in court. I 716 00:33:14.079 --> 00:33:16.279 don't think I would survive a Daubert challenge or anything. 717 00:33:16.279 --> 00:33:20.960 I'm not a professional expert witness by trade things like 718 00:33:21.039 --> 00:33:22.920 the government Safe Work. I mean, I'm a I'm a 719 00:33:22.920 --> 00:33:26.559 GSA Safe Involved Technician and inspector. It's a very long 720 00:33:26.839 --> 00:33:28.799 long set of training. You take it at MBA or 721 00:33:28.799 --> 00:33:31.319 you take it at Lockmasters. It's two weeks long. I 722 00:33:31.319 --> 00:33:35.119 don't spend all my days on military bases and government installations, 723 00:33:35.400 --> 00:33:36.599 servicing safes and vaults. 724 00:33:36.960 --> 00:33:39.720 But I'm certified to I can help you build a skiff. 725 00:33:40.440 --> 00:33:42.160 And you know, the one time a year that we 726 00:33:42.160 --> 00:33:44.920 have a client who says, hey, we need a you know, 727 00:33:45.000 --> 00:33:48.279 skiff certified room in this new building, or the one 728 00:33:48.359 --> 00:33:50.559 or two times I'll do because you don't make a lot. 729 00:33:50.480 --> 00:33:52.440 Of money on a lot of these government jobs. They're 730 00:33:52.480 --> 00:33:53.680 they're they're GSA rates. 731 00:33:54.000 --> 00:33:55.799 But I'll get a call from an army base I 732 00:33:55.799 --> 00:33:59.240 live right near, you know, for Lewis McCord, or I'll 733 00:33:59.240 --> 00:34:01.440 get a call like there was a Secret Service office 734 00:34:01.440 --> 00:34:03.440 that called me and they said, hey, you know, we 735 00:34:03.480 --> 00:34:06.440 have this safe that we have to decomm usually decommissioning, 736 00:34:06.640 --> 00:34:08.760 but like, yeah, we're trying to break this office down 737 00:34:09.159 --> 00:34:11.599 and we can't throw this freaking safe out because there 738 00:34:11.679 --> 00:34:12.519 might be contents in it. 739 00:34:12.519 --> 00:34:15.800 The custodians long retired. We got to get somebody in there. 740 00:34:16.119 --> 00:34:17.639 And I'll take the job just for the fun of it, 741 00:34:17.679 --> 00:34:19.880 just to keep the skills fresh into it's fun. It's 742 00:34:19.880 --> 00:34:21.400 fun to make some sparks and make a little bit 743 00:34:21.440 --> 00:34:23.559 of smoke, and then you kind of turn your back 744 00:34:23.599 --> 00:34:27.440 as the custodian opens the control drawer and you hear like, 745 00:34:27.519 --> 00:34:29.280 there's there's a video on my YouTube channel where I 746 00:34:29.280 --> 00:34:31.920 actually they allowed me to record. And the screen goes 747 00:34:31.960 --> 00:34:33.480 black so you don't see what he's but you hear 748 00:34:33.559 --> 00:34:35.639 him go, oh man, there was way more in here 749 00:34:35.639 --> 00:34:36.320 than we thought there. 750 00:34:36.199 --> 00:34:38.880 Was a year. Oly, shit, there's a good gun in here, 751 00:34:38.920 --> 00:34:41.760 you know. Take that. Yeah, so I'll do it. I'll 752 00:34:41.760 --> 00:34:42.719 do it just for the fun of that. 753 00:34:43.280 --> 00:34:47.079 So let's start jumping into the topic of safety and 754 00:34:47.239 --> 00:34:50.480 safe cracking. I think before we get into the cracking aspect, 755 00:34:50.840 --> 00:34:52.719 we should probably talk a little bit about safes. 756 00:34:53.639 --> 00:34:54.280 Most people. 757 00:34:54.440 --> 00:34:56.519 I think most listeners know what a safe is and 758 00:34:56.599 --> 00:34:59.159 have some idea in their mind from like a Donald 759 00:34:59.239 --> 00:35:02.639 Duck cartoon guy turning the dial and the door opens 760 00:35:02.679 --> 00:35:06.079 and you keep your gold coins inside. But you want 761 00:35:06.079 --> 00:35:08.280 to talk a little bit about the development of safes, 762 00:35:09.079 --> 00:35:11.719 the modernization of them, what people use them for, the 763 00:35:11.719 --> 00:35:13.320 different types of safes that are out there. 764 00:35:15.320 --> 00:35:20.280 Certainly, certainly a safe or any storage container, a safe, 765 00:35:20.320 --> 00:35:24.719 a vault, a safe room. The idea is to make 766 00:35:24.760 --> 00:35:29.719 a container that is not impenetrable, because nothing's impenetrable, but 767 00:35:29.840 --> 00:35:34.599 you want to cause an attacker more headache than it 768 00:35:34.639 --> 00:35:38.079 would be ultimately worth for them to gain the spoils 769 00:35:38.119 --> 00:35:43.320 that are contained within. So if you have your jewelry 770 00:35:43.320 --> 00:35:46.400 in your house and your you know, your your important documents, 771 00:35:46.440 --> 00:35:49.440 whatever will assign a value to that. Maybe you have 772 00:35:49.480 --> 00:35:51.760 a very nice gun collection, your you know, you and 773 00:35:51.760 --> 00:35:53.000 your spouse and your kids have. 774 00:35:53.039 --> 00:35:55.440 Some valuable jewelry that you've gotten over the years. 775 00:35:55.840 --> 00:35:58.199 Call it, I don't know, fifty thousand dollars, one hundred 776 00:35:58.239 --> 00:36:01.840 thousand dollars, anything more than that. In terms of financial 777 00:36:01.840 --> 00:36:04.199 instruments and hard you should probably be putting them in 778 00:36:04.239 --> 00:36:06.320 a bank vault or a safe deposit box somewhere, in 779 00:36:06.360 --> 00:36:10.639 my opinion, but you might have fifty k. Well, an attacker, 780 00:36:11.039 --> 00:36:13.639 if they know that you have, that's a really wealthy home, 781 00:36:13.719 --> 00:36:16.119 let's break in there and steal stuff. If it's going 782 00:36:16.159 --> 00:36:20.480 to cost the attacker, like let's say ten twenty thousand 783 00:36:20.519 --> 00:36:23.280 dollars and specialize drill rigs, and like, I have all 784 00:36:23.320 --> 00:36:25.760 this safe cracking equipment, but it costs money, right, And 785 00:36:25.800 --> 00:36:27.519 it's going to cost the attacker a lot of time 786 00:36:27.599 --> 00:36:30.840 and effort, and they're making a lot of noise and 787 00:36:30.880 --> 00:36:33.840 they're worried about their exposure and their likelihood of getting caught. 788 00:36:34.599 --> 00:36:36.960 The attacker is going to kind of do the math 789 00:36:37.000 --> 00:36:39.199 and say, ah, it's not worth it. I'm going to 790 00:36:39.400 --> 00:36:42.920 break in somebody else's house down the road. A safe 791 00:36:43.000 --> 00:36:46.760 or a vault is designed to cause more headache, time delay, 792 00:36:46.960 --> 00:36:50.760 energy effort, and resource spend than the attacker would gain 793 00:36:51.239 --> 00:36:55.960 demonstrability by by the risk of breaking in. So historically 794 00:36:56.000 --> 00:37:00.760 this was all brute force, you see, you know, like 795 00:37:00.840 --> 00:37:04.119 the old the old West, like people dynamiting safes and 796 00:37:04.159 --> 00:37:04.679 things like that. 797 00:37:05.519 --> 00:37:06.480 That's that's what you would have. 798 00:37:06.599 --> 00:37:09.880 You'd have usually round almost like the old Victor cannon 799 00:37:09.880 --> 00:37:13.719 balls type safe. You'd have these cast iron, very thick doors, 800 00:37:15.039 --> 00:37:18.559 and the lock mechanism was was not something somebody would 801 00:37:18.559 --> 00:37:21.760 tinker with the lock and a combination on the lock 802 00:37:22.519 --> 00:37:24.840 was designed like if you didn't know the combination. People 803 00:37:24.840 --> 00:37:28.239 weren't teaching safe cracking as a skill broadly back then. 804 00:37:29.000 --> 00:37:32.400 It was all about that pry bars and nitroglycerine and 805 00:37:32.440 --> 00:37:35.800 how how can you withstand detonating the safe or if 806 00:37:35.800 --> 00:37:37.159 you had to blow the safe up, we'll it blow 807 00:37:37.199 --> 00:37:37.880 up all the money in it. 808 00:37:37.920 --> 00:37:41.440 I think that was in maybe some old Cowboy movie 809 00:37:41.480 --> 00:37:43.320 where they blow up a safe but then the money 810 00:37:43.360 --> 00:37:45.320 all gets you know, gets burned up inside the monton 811 00:37:45.440 --> 00:37:47.480 they're going through. This one's pretty good. I think this now, 812 00:37:47.480 --> 00:37:48.599 this bill is a lost cause. 813 00:37:49.599 --> 00:37:54.400 But over time we do run the risks of not 814 00:37:54.519 --> 00:37:56.280 just so sort of smack and grab. 815 00:37:56.960 --> 00:37:58.880 We started saying, well, what about. 816 00:37:58.639 --> 00:38:02.320 If an authorized person were to try to steal from 817 00:38:02.360 --> 00:38:06.599 the safe? What if somebody were to use duress on 818 00:38:06.679 --> 00:38:09.360 an authorized person and say, hey, you open the safe 819 00:38:09.400 --> 00:38:12.480 right now for me, Which didn't happen nearly as much 820 00:38:12.480 --> 00:38:14.920 as we are led to believe by Hollywood. It was 821 00:38:14.960 --> 00:38:19.280 actually very hard to hold up a town in the 822 00:38:19.280 --> 00:38:22.480 Old West because you'd have to get away right. I mean, 823 00:38:22.639 --> 00:38:24.599 there's only one or two roads out of town right 824 00:38:24.760 --> 00:38:25.320 there where to go. 825 00:38:25.840 --> 00:38:27.480 You're on a horse. Guess what everyone else is on 826 00:38:27.480 --> 00:38:30.000 a horse. Yeah, if your horse runs. 827 00:38:29.719 --> 00:38:32.719 Out of energy fifty miles outside of town, the people 828 00:38:32.840 --> 00:38:34.440 coming behind you with all their guns, they're gonna be 829 00:38:34.480 --> 00:38:37.519 right on your heels. Those sort of robberies like that. 830 00:38:37.679 --> 00:38:41.320 Bank robberies really change with the automobile. That's the history 831 00:38:41.360 --> 00:38:44.920 of modern bank robberies with sort of Dillinger and Bonnie 832 00:38:44.960 --> 00:38:49.199 and Clyde and Lamb. But the idea of a bank 833 00:38:49.280 --> 00:38:52.960 robber who would maybe not use brute force or duress, 834 00:38:53.480 --> 00:38:55.239 but who would use you know, like I'm going to 835 00:38:55.280 --> 00:38:58.239 be the inside man breaking in. That was also a 836 00:38:58.280 --> 00:39:01.159 real big concern in the government as we started to 837 00:39:01.159 --> 00:39:04.880 see the modernization of the intelligence apparatus in our country, 838 00:39:05.119 --> 00:39:08.280 which is really a product of the First World War, 839 00:39:08.360 --> 00:39:10.440 the interwar years with the OSS and then of. 840 00:39:10.360 --> 00:39:11.119 Course World War Two. 841 00:39:11.119 --> 00:39:13.360 It is when we get really the modern intelligence community, 842 00:39:14.119 --> 00:39:17.280 the idea of classified documents and document storage, and what 843 00:39:17.400 --> 00:39:21.239 if we have spies who have been bribed or leveraged, Well, 844 00:39:21.280 --> 00:39:22.519 this person knew the combination. 845 00:39:22.719 --> 00:39:24.599 It's not how robust the safe is and how we 846 00:39:24.639 --> 00:39:25.039 prevent that. 847 00:39:25.119 --> 00:39:27.480 So that's where we start to see things like the 848 00:39:27.480 --> 00:39:30.760 development of timelocks, where on the inside of the safe 849 00:39:30.800 --> 00:39:33.320 door there is a movement, there's a mechanical time movement, 850 00:39:33.679 --> 00:39:37.559 and you set it and until that clock winds down, 851 00:39:38.079 --> 00:39:43.800 the safe simply cannot be effectively opened. And timelocks were 852 00:39:43.800 --> 00:39:47.320 great for a while until, as I like to remind people, 853 00:39:47.719 --> 00:39:50.000 December seventh, nineteen forty one, the day that we'll live 854 00:39:50.039 --> 00:39:53.480 in infamy, was a Sunday and there's actual stories during 855 00:39:53.559 --> 00:39:57.239 the attack on Pearl where people were running around at 856 00:39:57.280 --> 00:39:59.840 the Navy base. They're running around Schofield Barracks, Hickham Field, 857 00:40:00.119 --> 00:40:02.320 and they're like trying to get into the safes to 858 00:40:02.320 --> 00:40:05.559 get the war plants because the Japanese zeros are flying 859 00:40:05.559 --> 00:40:07.320 out of the sky and things are blown up in 860 00:40:07.320 --> 00:40:09.880 the harbor and all of a sudden, Oh wow, war 861 00:40:09.920 --> 00:40:10.679 is seven days a week. 862 00:40:10.719 --> 00:40:11.639 We can't just use. 863 00:40:11.440 --> 00:40:15.440 Timelocks anymore for our government safes. Banks to this day, 864 00:40:15.480 --> 00:40:18.880 banks still use timelocks. Civilian world still uses timelocks extensively. 865 00:40:19.920 --> 00:40:24.039 But the development of manipulation resistant or what some people 866 00:40:24.039 --> 00:40:29.280 we call manipulation proof kind of anti manipulation safe mechanisms 867 00:40:29.559 --> 00:40:33.079 and dual custody safe locks. This is all a product 868 00:40:33.079 --> 00:40:36.440 of the Second World War and the immediate post World 869 00:40:36.480 --> 00:40:39.360 War two kind of Cold War era, the espionage era 870 00:40:39.480 --> 00:40:42.719 being really in its heyday. That's where we see the 871 00:40:42.760 --> 00:40:46.599 modern landscape of safes and vaults and mechanisms that are 872 00:40:46.639 --> 00:40:50.679 meant not just to resist brute force, but are meant 873 00:40:50.719 --> 00:40:55.119 to prevent unauthorized access from all different manifold angles. 874 00:40:56.400 --> 00:40:59.440 Hey, guys, our show is sponsored by ghost Bag. Check 875 00:40:59.480 --> 00:41:03.519 them out. Please to make awesome mattresses, Awesome pillows, awesome betting. 876 00:41:04.079 --> 00:41:08.239 Ghostpread provides high quality, is super comfortable, award winning mattresses 877 00:41:08.320 --> 00:41:11.320 crafted in the US and Canada. Did you know that 878 00:41:11.440 --> 00:41:13.960 sixty percent of US adults report being too hot when 879 00:41:14.000 --> 00:41:17.159 they're trying to sleep. That's me, I'm a sweaty little baby. 880 00:41:17.800 --> 00:41:20.199 That's why we designed all of our products with cooling 881 00:41:20.199 --> 00:41:23.440 features so you stay comfortable and asleep all night long. 882 00:41:24.199 --> 00:41:27.400 Pair any of our mattresses with ghost Beds Award winning 883 00:41:27.400 --> 00:41:31.360 adjustable base and get the ultimate sleep experience. Ghost Bearded 884 00:41:31.440 --> 00:41:35.440 Rules the family owned business sixty thousand plus five star reviews. 885 00:41:35.840 --> 00:41:38.760 They have sleep experts on staff with twenty plus years 886 00:41:38.800 --> 00:41:40.800 of experience. If you have any questions, you can hit 887 00:41:40.840 --> 00:41:43.079 them up and ask them, you know, maybe what kind 888 00:41:43.079 --> 00:41:46.960 of mattresses work for you. Twenty plus year warranty that's 889 00:41:47.000 --> 00:41:50.719 two times the industry standard. Free shipping and returns on mattresses. 890 00:41:50.800 --> 00:41:53.639 Most of the products ship out within twenty four hours. 891 00:41:54.000 --> 00:41:57.119 They have in house customer support and sleep actress Sleep 892 00:41:57.159 --> 00:42:02.159 experts chilling in Plantation, Florida. It rules It's the best. 893 00:42:02.159 --> 00:42:05.599 They give you one hundred and one night's risk free 894 00:42:05.639 --> 00:42:07.639 to make sure that these beds are right for you. 895 00:42:08.039 --> 00:42:10.039 If you don't like it after one hundred and one nights, 896 00:42:10.039 --> 00:42:12.000 you could send it back full refund. 897 00:42:12.400 --> 00:42:12.519 Uh. 898 00:42:12.760 --> 00:42:16.440 When you purchase a ghost bed mattress, you're comfort guaranteed. 899 00:42:16.440 --> 00:42:20.400 I'm reading it right now, and it's capital letters guaranteed. Okay, 900 00:42:20.719 --> 00:42:22.679 they do the right thing and they're a great company. 901 00:42:23.280 --> 00:42:25.280 If you're not sure which ghost bed's right for you, 902 00:42:25.360 --> 00:42:27.079 like I said before, you could take you could take 903 00:42:27.119 --> 00:42:30.280 their mattress quiz online or you can give a call 904 00:42:30.360 --> 00:42:32.239 to one of their sleep experts and they'll help you 905 00:42:32.320 --> 00:42:35.760 with exactly what you possibly could need, what works for you, 906 00:42:35.800 --> 00:42:39.000 and what doesn't. And the best news about this is 907 00:42:39.280 --> 00:42:42.239 teamhouse listeners and viewers. You get an extra ten percent 908 00:42:42.320 --> 00:42:45.360 off sitewide for a limited time. You just go to 909 00:42:45.400 --> 00:42:48.800 ghostped dot com slash house and use the code house 910 00:42:48.880 --> 00:42:52.039 at checkout one more time. That's ghost sped dot com 911 00:42:52.320 --> 00:42:56.960 slash house with the code house ho u se at 912 00:42:57.039 --> 00:43:01.079 checkout for an extra ten percent off site wide. I 913 00:43:01.119 --> 00:43:03.639 want to thank go sped for their continued support. I 914 00:43:03.679 --> 00:43:05.800 want to thank all the fans that listen and watch 915 00:43:05.840 --> 00:43:08.760 for their continued support. Without you, guys, we are nothing. 916 00:43:09.599 --> 00:43:11.719 So thank you for supporting the show, and thank you 917 00:43:11.760 --> 00:43:15.199 for supporting the companies that help support the show. Gospad 918 00:43:15.280 --> 00:43:18.519 dot com, slash House for ten percent off, made in 919 00:43:18.559 --> 00:43:20.800 the US, Made in Canada. Shout out to our brothers 920 00:43:20.800 --> 00:43:24.079 in Canada. They rock. Check them out. I love ghosped. 921 00:43:24.360 --> 00:43:24.960 Thanks guys. 922 00:43:26.280 --> 00:43:28.119 Hey, guys, I want to tell all of you today 923 00:43:28.199 --> 00:43:31.400 about a new newsletter that we're launching that encompasses both 924 00:43:31.480 --> 00:43:35.679 the Teamhouse podcast, the eyes On podcast, and the high 925 00:43:35.719 --> 00:43:40.440 Side News outlet, which I run with Sean Naylor. The 926 00:43:40.440 --> 00:43:42.800 newsletter is going to be once a week. It's going 927 00:43:42.840 --> 00:43:45.159 to come into your inbox and you're going to get 928 00:43:45.159 --> 00:43:48.760 the most current podcasts on eyes On and the Teamhouse 929 00:43:49.119 --> 00:43:52.960 and whatever's topical or current on the high Side. So 930 00:43:53.119 --> 00:43:55.159 it's another way for us to get the information out 931 00:43:55.159 --> 00:43:59.000 to you as social media algorithms are pretty iffy and 932 00:43:59.039 --> 00:43:59.719 you never really know. 933 00:43:59.719 --> 00:44:02.039 What you're gonna get. So this is a once a 934 00:44:02.039 --> 00:44:02.679 week email. 935 00:44:02.840 --> 00:44:05.199 It'll slide into your inbox and it will have you 936 00:44:05.239 --> 00:44:06.800 know the greatest hits of that week. 937 00:44:06.880 --> 00:44:09.239 It's really good man checking it out. 938 00:44:10.159 --> 00:44:14.440 The website for it is Teamhouse Podcast, dot kit dot com, 939 00:44:14.440 --> 00:44:18.880 slash Join Teamhouse podcast, dot kit dot com. 940 00:44:18.599 --> 00:44:19.360 Slash join. 941 00:44:20.000 --> 00:44:22.320 H you go there and you enter into your email list, 942 00:44:22.559 --> 00:44:26.159 or you enter your email into the little thing on 943 00:44:26.199 --> 00:44:28.679 the website and you're good to go, and that'll be it. 944 00:44:29.400 --> 00:44:32.440 So we really appreciate your support and hope you'll consider 945 00:44:32.480 --> 00:44:33.039 signing up. 946 00:44:33.239 --> 00:44:33.960 Where's the link. 947 00:44:34.840 --> 00:44:37.400 The link will also be down the description if you're 948 00:44:37.440 --> 00:44:38.360 looking for it there. 949 00:44:38.400 --> 00:44:43.559 And that's Teamhouse podcast, dot Kit, k I, t Kilo, India, 950 00:44:43.760 --> 00:44:47.519 Tango dot com, backslash Join. 951 00:44:51.239 --> 00:44:56.719 Fascinating And so I never knew that about World War Two? 952 00:44:56.719 --> 00:45:00.920 Did you jack about Pearl Harbord? Yeah, first time or that? Fascinating? 953 00:45:01.280 --> 00:45:07.760 So what yeah, what are the steps to you know, 954 00:45:07.800 --> 00:45:12.159 because like you know, when we look at modern movies 955 00:45:12.239 --> 00:45:15.119 or even older movies, you know, the criminal always gets 956 00:45:15.280 --> 00:45:18.519 an exact replica of the safe and then they spend 957 00:45:18.760 --> 00:45:21.519 you know, days or weeks practicing on it with their 958 00:45:21.599 --> 00:45:24.880 stethoscope or you know, their drill where it just hits 959 00:45:24.960 --> 00:45:28.760 the glass pane. But what are the actual steps for 960 00:45:28.920 --> 00:45:30.679 a modern like safe cracker? 961 00:45:33.920 --> 00:45:37.639 So that's a really cool question. And a guy I 962 00:45:37.840 --> 00:45:39.719 like very much. He's been in touch with me in 963 00:45:39.719 --> 00:45:42.119 the past. He's an icon of the industry. Dave mccomy. 964 00:45:43.239 --> 00:45:45.920 He actually appears in some videos online. 965 00:45:45.920 --> 00:45:48.679 He's been interviewed about how realistic was this or that 966 00:45:48.719 --> 00:45:50.800 scene in a movie. He has a wonderful walkthrough. 967 00:45:50.840 --> 00:45:52.679 I'll send you the URL if you'll put in the 968 00:45:52.679 --> 00:45:55.880 show out puts for people. But it is true that 969 00:45:56.519 --> 00:46:00.320 safe crackers and technicians need to know, like what's on 970 00:46:00.360 --> 00:46:02.920 the other side of that steel door, what is the 971 00:46:02.960 --> 00:46:06.559 mechanism and learning about it, either by getting a replica 972 00:46:06.559 --> 00:46:09.519 of the safe or if you're on the up and up, 973 00:46:09.559 --> 00:46:13.760 if you're in the actual SAFTA Safe Involved Technicians Association land. 974 00:46:14.239 --> 00:46:15.800 There's a whole knowledge database. 975 00:46:16.320 --> 00:46:19.440 There's there's the List Council, there's locknet, there's whole databases 976 00:46:19.480 --> 00:46:22.320 that you can reference that show oh this From this 977 00:46:22.400 --> 00:46:25.159 year to this year, dee Bold Mosler was making their 978 00:46:25.239 --> 00:46:27.559 vault doors with this mechanism and this bolt work on this. 979 00:46:28.000 --> 00:46:30.039 So this is where the mechanism is, this is where 980 00:46:30.039 --> 00:46:31.679 the drill point is. This is where you want to 981 00:46:31.760 --> 00:46:34.000 be careful. There's a relock trigger over here, there's a 982 00:46:34.000 --> 00:46:37.880 relock device over here. So knowing what's on the inside 983 00:46:38.320 --> 00:46:42.280 is often the first step in trying to either neutralize 984 00:46:42.280 --> 00:46:44.960 a safe or even just diagnose a problem, you know, 985 00:46:45.119 --> 00:46:49.559 figuring out Oh, okay, the safe was working yesterday, customer 986 00:46:49.599 --> 00:46:50.880 reports it doesn't work today. 987 00:46:51.559 --> 00:46:53.440 Well, if you roll up over there and you say, 988 00:46:54.039 --> 00:46:54.559 how are. 989 00:46:54.400 --> 00:46:57.320 You show me how you're dialing the safe, and you 990 00:46:57.360 --> 00:46:59.119 watch them and you say that that should work. 991 00:47:00.079 --> 00:47:00.639 Is that not working? 992 00:47:00.639 --> 00:47:02.599 And then you think to yourself, way, I know safe 993 00:47:02.599 --> 00:47:05.960 technicians that have safe different models of safelock, you know, 994 00:47:06.039 --> 00:47:09.079 in their van, and they'll deuld a cutaway and they'll 995 00:47:09.079 --> 00:47:10.000 they'll actually. 996 00:47:09.800 --> 00:47:12.159 Wait a minute. If I'm if I'm turning a clockwise 997 00:47:12.199 --> 00:47:13.760 what the what the frig am I doing? They're looking 998 00:47:13.800 --> 00:47:15.880 at they go, no, no, no, the fly. 999 00:47:16.119 --> 00:47:21.239 Okay, so you might have a stuck fly going counter counterclockwise. Okay, 1000 00:47:21.519 --> 00:47:23.239 try it this way here, turn the thing and you 1001 00:47:23.239 --> 00:47:24.639 can get a dead blow hammer and you say, wait, 1002 00:47:24.639 --> 00:47:29.360 don't turn the number. Bang tile the next number now okay, okay, 1003 00:47:29.400 --> 00:47:30.280 Now you're about to hit the bolt. 1004 00:47:30.320 --> 00:47:33.760 Work on this side, bam. Okay. Yeah, we got to 1005 00:47:33.880 --> 00:47:36.239 open cool because you need to know if I hit 1006 00:47:36.239 --> 00:47:38.639 it right about here, if something stuck or wasn't greased. 1007 00:47:39.159 --> 00:47:39.360 Yeah. 1008 00:47:39.480 --> 00:47:41.199 Knowing what's on the inside of the door is a 1009 00:47:41.280 --> 00:47:43.480 huge part of the whole process. 1010 00:47:43.360 --> 00:47:45.639 Fascinating, it's fascinating. 1011 00:47:45.840 --> 00:47:47.360 Do you want to talk a little bit because I 1012 00:47:47.360 --> 00:47:49.480 think during your talk at def Con you mentioned this 1013 00:47:49.559 --> 00:47:52.960 a little bit about what the stethoscope actually was and 1014 00:47:53.000 --> 00:47:55.280 how there was a period maybe a brief period of 1015 00:47:55.280 --> 00:47:58.280 time where that was useful but not today. 1016 00:47:58.480 --> 00:47:59.559 Yeah. 1017 00:47:59.679 --> 00:48:02.960 Yes, so to this day, if you're doing manipulation, this 1018 00:48:03.079 --> 00:48:05.199 is with mechanical, purely mechanical safe locks. 1019 00:48:05.280 --> 00:48:07.159 I mean there are attacks for electronic safes as. 1020 00:48:07.119 --> 00:48:12.400 Well, but manipulation, as we've often seen in Hollywood, you'll see, 1021 00:48:12.760 --> 00:48:15.159 as you mentioned, the stethoscope or the low tech is 1022 00:48:15.159 --> 00:48:16.639 like putting the you know, the ear up to a 1023 00:48:16.639 --> 00:48:21.400 glass or something like that. You're not really hearing a 1024 00:48:21.440 --> 00:48:25.199 lot of many mechanisms clicking and clanking, like the Foley 1025 00:48:25.239 --> 00:48:27.119 guy doing the production of a film likes. 1026 00:48:27.039 --> 00:48:28.400 To add all these sound effects. 1027 00:48:29.360 --> 00:48:33.719 What you're trying to find is very precisely learning what 1028 00:48:33.840 --> 00:48:39.239 are called contact points. It's a very specific area of 1029 00:48:39.280 --> 00:48:42.880 the safe dial where to use some technical terms, where 1030 00:48:42.960 --> 00:48:45.880 the nose on the lever arm is trying to drop 1031 00:48:45.920 --> 00:48:48.960 into the opening on what's called a cam wheel and 1032 00:48:49.000 --> 00:48:52.440 you're trying to find okay, touch here, touch here, and 1033 00:48:52.480 --> 00:48:56.960 as you're dialing the dial. You're dialing this cam wheel touch, touch, touch, 1034 00:48:57.280 --> 00:49:00.320 and you want to get those contact points very care fully, 1035 00:49:00.320 --> 00:49:05.000 carefully identified, because as you manipulate, the process of manipulating 1036 00:49:05.000 --> 00:49:11.000 a safe is experimenting with different numbers around the wheel 1037 00:49:11.559 --> 00:49:16.840 and seeing if those contact points change very slightly, it's 1038 00:49:16.880 --> 00:49:19.039 actually happening. And I don't know if your viewers are 1039 00:49:19.039 --> 00:49:21.920 getting this and audio only if they're seeing my hands 1040 00:49:21.920 --> 00:49:24.320 in front of my black shirt here, but imagine if 1041 00:49:24.320 --> 00:49:27.639 that nose is dropping a little further into an aperture, 1042 00:49:27.960 --> 00:49:30.679 those contact points will get a little tighter together than 1043 00:49:30.679 --> 00:49:33.800 they would if you were up here higher up. You're 1044 00:49:33.840 --> 00:49:36.880 looking for where the safe wheels are almost lined up 1045 00:49:36.880 --> 00:49:39.199 but not fully lined up, and you're taking notes. You say, oh, 1046 00:49:39.360 --> 00:49:43.159 something's happening around seventeen, question mark seventeen, and you come 1047 00:49:43.199 --> 00:49:45.719 back and you run the numbers again and you say, okay, no, 1048 00:49:45.920 --> 00:49:49.079 I'm seeing something on forty two maybe, And you're slowly 1049 00:49:49.119 --> 00:49:52.559 getting the safe to leak information out at you. But 1050 00:49:52.679 --> 00:49:55.400 as Dave and others have pointed out in their videos 1051 00:49:55.400 --> 00:49:59.320 about the subject, you're doing much more visual observation. So 1052 00:49:59.360 --> 00:50:01.400 it's fine if you want to use a stethoscope, or 1053 00:50:01.400 --> 00:50:03.760 in modern times we would use an audio amplifier a 1054 00:50:03.760 --> 00:50:07.800 little magnetic microphone. You could hear the contact points, but 1055 00:50:08.159 --> 00:50:10.679 you're never in Hollywood. You're often just kind of you 1056 00:50:10.679 --> 00:50:13.119 see the person is looking off into space as they're 1057 00:50:13.159 --> 00:50:16.119 just listening, just listening. What you're really doing is listening 1058 00:50:16.119 --> 00:50:18.079 and looking particularly. 1059 00:50:18.480 --> 00:50:21.039 And what are you are you looking for like little 1060 00:50:21.119 --> 00:50:24.159 hitches and then as the dial goes or something like that. 1061 00:50:24.559 --> 00:50:28.119 Yeah, you're looking for the behavior of the dial at 1062 00:50:28.159 --> 00:50:30.599 a very specific spot where it would be called the 1063 00:50:30.679 --> 00:50:31.559 drop in area. 1064 00:50:31.559 --> 00:50:33.000 That's where the contact points are. 1065 00:50:33.400 --> 00:50:35.920 And if those contact points, if I'm running the dial 1066 00:50:36.280 --> 00:50:39.159 and my contact points are always let's call it ninety 1067 00:50:39.159 --> 00:50:42.400 eight and seven, and I run the dial some more 1068 00:50:42.480 --> 00:50:44.599 ninety eight seven, ninety eight to seven, and then I'm 1069 00:50:44.639 --> 00:50:46.159 starting to and I get to a point where I'm 1070 00:50:46.159 --> 00:50:47.519 trying some numbers, and then I come back to my 1071 00:50:47.559 --> 00:50:48.519 contact points. 1072 00:50:48.239 --> 00:50:51.280 And then all of a sudden, it's at ninety nine 1073 00:50:51.679 --> 00:50:56.760 and six, Like my contact points got a little tighter together. 1074 00:50:57.119 --> 00:50:59.800 I think my nose is dropping a little further into 1075 00:50:59.840 --> 00:51:01.280 the cams. 1076 00:51:01.360 --> 00:51:02.239 Let's jot that down. 1077 00:51:02.239 --> 00:51:04.920 I might have a good number there now, just because 1078 00:51:04.960 --> 00:51:07.239 you found a potential number, or you don't know where 1079 00:51:07.239 --> 00:51:10.000 in the combination that is, there's a series of diagnostic 1080 00:51:10.079 --> 00:51:12.800 dialing techniques that you would use to try to determine 1081 00:51:13.079 --> 00:51:15.719 where on the dial or where in the combination. 1082 00:51:15.360 --> 00:51:17.639 That the dial should be dialed to that number, and 1083 00:51:17.679 --> 00:51:18.239 little by then. 1084 00:51:18.320 --> 00:51:20.199 And sometimes it's fun sometimes if you're working with the 1085 00:51:20.239 --> 00:51:23.440 customer and you say, I'm finding a seventeen and I'm 1086 00:51:23.480 --> 00:51:26.920 finding a seventy six, and they say, oh, yeah, that's right, 1087 00:51:27.320 --> 00:51:30.280 Dad loves seventeen seventy the real patriot. That's the second 1088 00:51:30.320 --> 00:51:33.199 and third digits. I remember that now, and say, well, 1089 00:51:33.239 --> 00:51:34.079 does that jog your memory? 1090 00:51:34.159 --> 00:51:36.920 Oh? Do you remember the first friggin digit? We could just. 1091 00:51:36.880 --> 00:51:38.440 Dial for dollars, so we could just try all the 1092 00:51:38.599 --> 00:51:40.320 that you just reduce the key space to hell them 1093 00:51:40.320 --> 00:51:41.119 a lot by selling me. 1094 00:51:41.079 --> 00:51:46.079 That, Yeah, what you know, this itself sounds like it's 1095 00:51:46.079 --> 00:51:48.800 own specially right. And then you have all of the 1096 00:51:50.159 --> 00:51:53.920 alarm bypass, electrical bypass, all the different types of sensors, 1097 00:51:54.000 --> 00:51:58.639 all the different types of doors. Would you consider yourself 1098 00:51:59.239 --> 00:52:02.679 an X in all these things? Or do you consider 1099 00:52:02.679 --> 00:52:06.639 yourself like an expert in entry and being a generalist 1100 00:52:07.199 --> 00:52:10.119 and then like being able to brush up on stuff 1101 00:52:10.199 --> 00:52:10.760 as needed. 1102 00:52:13.880 --> 00:52:16.400 I think it's the hallmark of hubris of the worst 1103 00:52:16.480 --> 00:52:18.559 kind to consider yourself an expert in too many things, 1104 00:52:18.679 --> 00:52:21.639 or maybe any one thing at all. So I'll be 1105 00:52:21.679 --> 00:52:24.039 the first to point out I'm not necessarily an expert 1106 00:52:24.039 --> 00:52:27.800 in almost anything, but I'm a dedicated I'm a dedicated 1107 00:52:27.800 --> 00:52:30.519 person in many things. We will say there's a lot 1108 00:52:30.519 --> 00:52:32.159 of people I work with who disagree with me and 1109 00:52:32.199 --> 00:52:34.639 say I'm being too modest, probably, but that's for them 1110 00:52:34.639 --> 00:52:36.519 to come on and tell you about later. They can 1111 00:52:36.559 --> 00:52:38.239 talk about me. I'll talk about I work with plenty 1112 00:52:38.239 --> 00:52:41.079 of experts. I work with the electronic access control expert, 1113 00:52:41.159 --> 00:52:44.440 my colleague bobik who owns RTA and Core. I work 1114 00:52:44.480 --> 00:52:47.480 with my alarm system expert, our guy Brian, who came 1115 00:52:47.519 --> 00:52:51.639 out of the intelligence communities. Right, But I am I 1116 00:52:51.679 --> 00:52:55.000 am a specialist in several things, and I believe in 1117 00:52:55.159 --> 00:52:59.199 broadening your horizons as much as possible, which again it's been, 1118 00:52:59.679 --> 00:53:01.199 it's been an amazing journey. 1119 00:53:01.239 --> 00:53:03.159 I never was the ones and zero's person. 1120 00:53:03.199 --> 00:53:05.320 I mean, I was a network person, but I never 1121 00:53:05.480 --> 00:53:09.639 was an access control electronic locks person at all, and 1122 00:53:10.599 --> 00:53:14.039 through sitting it first, just sitting in the back of 1123 00:53:14.079 --> 00:53:16.159 the room. When you know a Red Team Alliance Access 1124 00:53:16.199 --> 00:53:18.239 Control class, I would just kind of sit in the 1125 00:53:18.239 --> 00:53:20.519 back in case somebody needed me to hand them something. 1126 00:53:20.559 --> 00:53:22.320 When I got to hand out the next access I'll 1127 00:53:22.320 --> 00:53:23.639 hand out the access control cards. 1128 00:53:24.079 --> 00:53:26.480 And then I would, you know, sit up front with 1129 00:53:26.519 --> 00:53:28.960 Bobbic and I would help him. I can teach the 1130 00:53:29.000 --> 00:53:31.519 basic pros cloning, I can. I can do that module 1131 00:53:31.559 --> 00:53:33.480 if you need to take a break from your easier voice. 1132 00:53:33.719 --> 00:53:37.960 And now I routinely fill in running whole sections of 1133 00:53:37.960 --> 00:53:40.880 the Access control class just because I work with these 1134 00:53:40.920 --> 00:53:44.000 exceptionally skilled people and it's rubbed off on me. 1135 00:53:44.440 --> 00:53:46.440 It's made me better to take Trent. 1136 00:53:46.639 --> 00:53:49.079 Just like the uh, you know, the forensics thing, Like, 1137 00:53:49.159 --> 00:53:51.760 I'm not an expert by any means at forensics, but 1138 00:53:51.880 --> 00:53:53.760 I wanted to learn lock forensics. 1139 00:53:54.159 --> 00:53:57.119 And you keep seeing these guys, you say, you gotta 1140 00:53:57.199 --> 00:53:59.599 come to my next class, man. You YouTube that yoused 1141 00:53:59.599 --> 00:54:01.239 to the first class, but let's come take the advanced 1142 00:54:01.280 --> 00:54:03.760 class next month. It's like, man, I don't do this 1143 00:54:03.800 --> 00:54:05.599 for a living. It's like, yeah, but you were great 1144 00:54:05.599 --> 00:54:06.239 in classes, sir. 1145 00:54:06.480 --> 00:54:07.920 Just come to your class man, and all of a 1146 00:54:07.960 --> 00:54:11.039 sudden you look around, you go, holy crap, Am I 1147 00:54:11.119 --> 00:54:12.360 better at this than the average bear? 1148 00:54:14.199 --> 00:54:14.320 Uh? 1149 00:54:14.760 --> 00:54:17.079 Let me also ask you about some of the other 1150 00:54:17.199 --> 00:54:19.760 tools that get used. You mentioned, you know, there's like 1151 00:54:19.840 --> 00:54:23.760 twenty thousand dollars drills, specialized drills. I've also heard about 1152 00:54:23.760 --> 00:54:29.480 the thermic lance gets used sometimes. Channeling our knowledge from 1153 00:54:29.840 --> 00:54:35.119 James Can's role in Thief, I think that's a nineteen 1154 00:54:35.440 --> 00:54:39.880 eighty one film, great movie. But anyway, what do he 1155 00:54:40.400 --> 00:54:42.199 What are some of the other tools of the trade 1156 00:54:42.239 --> 00:54:44.679 that get used even as we move forward into the 1157 00:54:44.760 --> 00:54:46.440 era of electronic locks? 1158 00:54:49.320 --> 00:54:52.400 Right on, right on, And yes, m Jimmy Kahn in 1159 00:54:52.480 --> 00:54:55.480 Thief is as a real rig that he is using. 1160 00:54:56.239 --> 00:54:59.280 The whoever their technical advisor was on that film is 1161 00:54:59.639 --> 00:55:02.880 exact because and again like Dave, Dave Mcomby did a 1162 00:55:02.880 --> 00:55:07.159 whole breakdown of that movie in one of his videos online, 1163 00:55:07.320 --> 00:55:08.840 and it's just it's. 1164 00:55:08.880 --> 00:55:11.280 And also I just like, well, I love Michael Man's work. 1165 00:55:11.480 --> 00:55:13.280 So it's like a whole world where cities are always 1166 00:55:13.280 --> 00:55:15.280 perpetually wet and at night. I just want the look 1167 00:55:15.280 --> 00:55:19.239 of it and the idea of these these big rigs. 1168 00:55:19.679 --> 00:55:24.039 What you're trying to do with most professional safe cracking 1169 00:55:24.079 --> 00:55:32.480 gear is apply force without fatiguing yourself and maintaining a 1170 00:55:32.639 --> 00:55:37.280 drill in a very accurate spot, because anybody can just 1171 00:55:37.360 --> 00:55:38.840 kind of go up with a giant Like when I'm 1172 00:55:38.960 --> 00:55:41.559 breaking into a government safe and they're taking it out 1173 00:55:41.599 --> 00:55:44.320 of service completely, I mean, I'll make a pretty big 1174 00:55:44.360 --> 00:55:47.320 friggin hole in it. I'll just I'll use a giant wholesaw, 1175 00:55:47.960 --> 00:55:50.360 and even then I'm still trying to not fatigue my arms. 1176 00:55:50.480 --> 00:55:52.239 I have a rig that'll mount to the front of 1177 00:55:52.280 --> 00:55:53.920 the of the safe, so I can just crank on it, 1178 00:55:54.119 --> 00:55:58.400 use a big quill. But you're trying to apply pressure 1179 00:55:58.440 --> 00:56:00.679 in a way that you can get through. Because they 1180 00:56:00.679 --> 00:56:02.880 are all different kinds of material, there's all kind of 1181 00:56:02.880 --> 00:56:07.960 metallurgy and cutting science. Are you doing a metal cutting technique, 1182 00:56:07.960 --> 00:56:11.159 are you doing a grinding technique? Are you doing precision 1183 00:56:11.159 --> 00:56:13.599 cutting where you're actually switching bits. There are plenty of 1184 00:56:13.599 --> 00:56:16.920 times where you're going through different styles of material. So 1185 00:56:16.960 --> 00:56:20.039 there's different types of barrier mesh. Where it's it's soft 1186 00:56:20.079 --> 00:56:23.119 mild steel, then it's the hard steel plate, then it's 1187 00:56:23.159 --> 00:56:25.280 ball bearings. It's something that's like hard plate that you 1188 00:56:25.320 --> 00:56:28.239 can't cut through with high speed steel you have to 1189 00:56:28.239 --> 00:56:31.079 switch to a diamond cutter where you're actually couring it 1190 00:56:31.119 --> 00:56:33.519 out and you're punching and you're cracking it away and 1191 00:56:33.519 --> 00:56:35.000 you're knocking debris out of a hole. 1192 00:56:35.559 --> 00:56:36.239 And then you switch. 1193 00:56:36.320 --> 00:56:39.239 Maybe you come up to maybe you're using, as you say, 1194 00:56:39.239 --> 00:56:41.639 a burning bar or thermic lance, and then there might 1195 00:56:41.679 --> 00:56:46.079 be a layer of material like copper in the middle 1196 00:56:46.159 --> 00:56:48.920 of the sick just to distribute the heat so and 1197 00:56:49.440 --> 00:56:52.519 copper won't a blake away. You can't oxidize like you 1198 00:56:52.559 --> 00:56:54.800 can do an oxidizing burn on cop do you have to. 1199 00:56:54.719 --> 00:56:57.760 Switch to switch to another tool, and all of these things. 1200 00:56:57.800 --> 00:57:01.400 It raises the stakes for the attack, and it raises 1201 00:57:01.440 --> 00:57:04.079 the level of investment that the attacker would have to have. 1202 00:57:04.679 --> 00:57:06.800 If this is your livelihood and you have a full 1203 00:57:06.840 --> 00:57:09.840 safetech shop, you have all the tools for an attacker 1204 00:57:09.880 --> 00:57:12.119 to break in. If they weren't playing, if this is 1205 00:57:12.159 --> 00:57:14.519 their one big score, they're not going to get through 1206 00:57:14.559 --> 00:57:14.880 all of that. 1207 00:57:14.880 --> 00:57:17.119 They would have to invest in so much time and training. 1208 00:57:17.519 --> 00:57:21.039 But yeah, the precision point, if you're even a quarter 1209 00:57:21.159 --> 00:57:24.639 inch off, you can not only miss your pot like 1210 00:57:24.639 --> 00:57:26.239 what you're drilling for, you can ruin the job. You 1211 00:57:26.239 --> 00:57:28.039 can not only fail to open it, you can make 1212 00:57:28.039 --> 00:57:31.320 it inoperable, completely unable to be opened ever again, well 1213 00:57:31.800 --> 00:57:34.239 without completely destroying a whole other side of the safe, 1214 00:57:34.320 --> 00:57:38.599 let's say, so maintaining that exact precision point. That's why 1215 00:57:38.639 --> 00:57:41.400 you see these large rigs that will be fixed in place, 1216 00:57:41.840 --> 00:57:45.239 either with a vacuum pump or magnetically attached, or by 1217 00:57:45.239 --> 00:57:46.880 some other means of stabilization. 1218 00:57:50.639 --> 00:57:52.679 I think all I ever learned was drill a hole 1219 00:57:52.719 --> 00:57:55.440 in it, filat with water and put some blasting cap center. 1220 00:57:55.639 --> 00:57:59.880 So I guess I guess that, uh, I guess that 1221 00:58:00.199 --> 00:58:00.639 the score. 1222 00:58:00.760 --> 00:58:03.559 The score was one of Brando's last pictures. De Niro 1223 00:58:03.719 --> 00:58:06.719 is in that with the young Ed Norton, and that 1224 00:58:06.840 --> 00:58:11.039 is it is based on a type of technique that 1225 00:58:11.360 --> 00:58:13.239 has been done. You. 1226 00:58:13.800 --> 00:58:15.760 The one major thing about that movie that's not really 1227 00:58:15.760 --> 00:58:18.800 is most safes aren't water tight. So in that movie, 1228 00:58:18.800 --> 00:58:22.440 they actually tap the I believe it's they tap the 1229 00:58:22.480 --> 00:58:23.280 sprinkler system. 1230 00:58:23.280 --> 00:58:24.519 They pull up a big. 1231 00:58:24.440 --> 00:58:27.880 Hose water down, and it wouldn't work that way in 1232 00:58:27.920 --> 00:58:31.119 real life. Which also I'm a I am a I'm 1233 00:58:31.159 --> 00:58:32.840 a fire services technician. Now I do a lot of 1234 00:58:32.880 --> 00:58:36.639 life safety and fire suppression inspection. And do you know 1235 00:58:36.679 --> 00:58:39.519 that if water is flowing through any sprinkler head, it'll 1236 00:58:39.519 --> 00:58:40.639 set off alarms in a building. 1237 00:58:40.760 --> 00:58:42.320 There's flow sensors that are. 1238 00:58:42.199 --> 00:58:45.480 All tied into any building automation and emergency services controls. 1239 00:58:45.800 --> 00:58:48.039 So you can't just get a bunch of water out 1240 00:58:48.079 --> 00:58:49.679 of the out of a sprinkler head and have nothing 1241 00:58:49.719 --> 00:58:50.519 go wrong in the building. 1242 00:58:50.559 --> 00:58:51.199 That won't work. 1243 00:58:52.280 --> 00:58:53.920 But that was a real technique. Yeah, but you would 1244 00:58:53.920 --> 00:58:55.280 have to tape the entire safe up. 1245 00:58:55.360 --> 00:58:58.159 You'd have to fill the whole safe with water by 1246 00:58:58.199 --> 00:58:59.960 sealing the entire safe shut. 1247 00:59:00.559 --> 00:59:04.599 That's fascinating. So with you know, Jacket mentioned you know, 1248 00:59:05.000 --> 00:59:07.840 like I think you mentioned biometrics, but like you know, 1249 00:59:07.880 --> 00:59:12.000 because both with your regular sort of breaking and entering stuff, 1250 00:59:12.039 --> 00:59:14.440 and you know, with the advent of the flipper and 1251 00:59:14.480 --> 00:59:16.519 you know, and all these other tools that are out 1252 00:59:16.519 --> 00:59:20.559 there now and with safe and security we see biometrics. 1253 00:59:20.840 --> 00:59:24.280 Are these systems more secure, less secure, or just secure 1254 00:59:24.280 --> 00:59:26.360 in a different way. 1255 00:59:27.719 --> 00:59:30.920 The diplomatic answer is that I like your phrasing. 1256 00:59:30.920 --> 00:59:31.519 They're secure in. 1257 00:59:31.519 --> 00:59:37.039 A different way. They are solving for a different problem. Nowadays, 1258 00:59:37.840 --> 00:59:41.920 loads of businesses you're let's stay a convenience store, you know, 1259 00:59:42.000 --> 00:59:44.199 like a seven to eleven or something might have a 1260 00:59:44.199 --> 00:59:47.000 cash safe. You know, the sticker on the door. Teller 1261 00:59:47.039 --> 00:59:49.400 does not have access to safe no more than twenty dollars. 1262 00:59:49.400 --> 00:59:50.239 Blah blah blahlah blah. 1263 00:59:50.840 --> 00:59:54.039 Those used to all be mechanical locks, and the teller 1264 00:59:54.039 --> 00:59:56.639 in fact would not the kid working the register wouldn't 1265 00:59:56.679 --> 01:00:00.119 have the combination was just the money drop guy and 1266 01:00:00.159 --> 01:00:00.679 the manager. 1267 01:00:02.400 --> 01:00:04.039 Those introduced a lot. 1268 01:00:03.880 --> 01:00:07.760 Of user friction, and they weren't really preventing a lot 1269 01:00:07.800 --> 01:00:10.880 of robberies. They you know, nowadays, if somebody is going 1270 01:00:10.960 --> 01:00:14.000 to try to steal from a money drop, they're going 1271 01:00:14.039 --> 01:00:15.679 to rob the bread truck, right, They're going to rob 1272 01:00:15.719 --> 01:00:18.079 the a car, the armored car. So they said, why 1273 01:00:18.119 --> 01:00:21.679 are we using these mechanical locks that are more cumbersome 1274 01:00:21.719 --> 01:00:24.599 to maintain. They're harder for a lot of customers to 1275 01:00:24.679 --> 01:00:28.079 learn how to use. Customers didn't really understand we live 1276 01:00:28.079 --> 01:00:30.320 in a world of keypads nowadays. If someone can dial 1277 01:00:30.360 --> 01:00:33.000 a phone, they can understand how to use a keypad. 1278 01:00:33.039 --> 01:00:38.239 Electronics safe safe technicians, especially older guys, didn't like the 1279 01:00:38.239 --> 01:00:42.719 introduction of electronics because they were quote less secure and yeah, 1280 01:00:42.800 --> 01:00:47.760 there's electronic bypads is a way easier than the mechanical one. 1281 01:00:48.199 --> 01:00:50.039 There is a tool called the Phoenix. There's a tool 1282 01:00:50.039 --> 01:00:53.239 called a little black box. We won't get way into 1283 01:00:53.320 --> 01:00:56.199 what's called differential power analysis, and that's how these tools work. 1284 01:00:56.679 --> 01:00:58.119 But there are tools that will pop up in a 1285 01:00:58.159 --> 01:01:02.000 lot of electronic locks very quick But that's not the 1286 01:01:02.119 --> 01:01:05.519 main problem that a lot of these safe manufacturers and 1287 01:01:05.559 --> 01:01:09.159 small businesses are solving for. The main problem they're solving 1288 01:01:09.199 --> 01:01:13.199 for is I need a way to very quickly operate 1289 01:01:13.199 --> 01:01:16.159 a safe and if I change the combination, I know 1290 01:01:16.199 --> 01:01:17.519 how to write down the com I know how to 1291 01:01:17.639 --> 01:01:18.679 enter the new combination. 1292 01:01:18.920 --> 01:01:20.039 I won't forget it. 1293 01:01:20.719 --> 01:01:23.199 And that Their day to day problem isn't a stick 1294 01:01:23.239 --> 01:01:25.159 up or a robbery. Their problem is like, Hey, the 1295 01:01:25.199 --> 01:01:27.159 guy from Brinx is waiting here and he's yelling at me, 1296 01:01:27.159 --> 01:01:28.840 and he says, sorry, you're taking too long. 1297 01:01:28.840 --> 01:01:30.079 I don't know what you're doing wrong. I'm going to 1298 01:01:30.119 --> 01:01:30.679 get you next week. 1299 01:01:31.079 --> 01:01:34.599 Right, So, electronic blocks are more convenient, they're not always 1300 01:01:34.599 --> 01:01:36.000 they're definitely not more secure. 1301 01:01:35.639 --> 01:01:36.199 In my opinion. 1302 01:01:36.440 --> 01:01:43.480 Right Right, Let's jump into the history of intelligence services 1303 01:01:43.639 --> 01:01:47.719 and how they intersect with this field to add a 1304 01:01:47.719 --> 01:01:50.159 little bit of context. For folks out there of like, 1305 01:01:50.320 --> 01:01:53.000 I think we should talk a little bit about why 1306 01:01:53.039 --> 01:01:57.039 this matters. Intelligence services are known to, amongst other things, 1307 01:01:57.079 --> 01:02:00.639 break into embassies and break into safes and those embassies 1308 01:02:01.280 --> 01:02:03.360 if not just take the safe out and break into 1309 01:02:03.400 --> 01:02:07.559 it off site somewhere. There's an article in Smithsonian magazine 1310 01:02:07.599 --> 01:02:09.000 that I think a lot of you guys would be 1311 01:02:09.079 --> 01:02:12.519 interested in. It's called the CIA Burglar Who Went Rogue 1312 01:02:12.880 --> 01:02:16.480 about this guy named Douglas Grout, and it's about this 1313 01:02:16.559 --> 01:02:19.760 guy who was a safe cracker for the CIA and 1314 01:02:19.840 --> 01:02:22.639 he broke into safes in all sorts of different embassies 1315 01:02:22.639 --> 01:02:25.480 and different parts of the world, and then he felt 1316 01:02:25.480 --> 01:02:27.440 that he got screwed over and he sort of tried 1317 01:02:27.440 --> 01:02:29.960 to blackmail the CIA for money and did it goes 1318 01:02:30.000 --> 01:02:34.159 so well? But that's an interesting article to talk about, 1319 01:02:34.239 --> 01:02:38.360 you know, how these intelligence services have these capabilities. I 1320 01:02:38.400 --> 01:02:40.440 don't know if you read that one deviant and what 1321 01:02:40.800 --> 01:02:43.119 your thoughts are about that particular incident. 1322 01:02:46.239 --> 01:02:50.360 Yeah, So the real fascinating thing about the IC world 1323 01:02:51.159 --> 01:02:55.039 is that these are technicians who aren't breaking in to 1324 01:02:55.199 --> 01:02:59.559 safes in a way that is easily detectable. Right many times, 1325 01:02:59.639 --> 01:03:02.760 I'm I can teach manipulation to anybody, any of y'all. 1326 01:03:02.760 --> 01:03:05.480 Like we teach a manipulation class at RTA, But for 1327 01:03:05.519 --> 01:03:07.440 the most part, I'm not usually manipulating a safe. 1328 01:03:07.440 --> 01:03:10.079 If somebody says, hey, this safe, you know, needs to 1329 01:03:10.079 --> 01:03:13.320 get opened, and even your best technicians nowadays drill and 1330 01:03:13.360 --> 01:03:14.360 repair and patch it up. 1331 01:03:14.400 --> 01:03:14.559 You can. 1332 01:03:14.800 --> 01:03:16.760 We can patch it up so it looks like we 1333 01:03:16.760 --> 01:03:20.519 were never there, but that takes a little while. And 1334 01:03:20.719 --> 01:03:24.000 if somebody inspects the inside of the safe, they can see, oh. 1335 01:03:23.880 --> 01:03:26.000 Yeah, look, take the panel off. You can see, oh 1336 01:03:26.039 --> 01:03:27.199 there's there's somebody was in here. 1337 01:03:27.800 --> 01:03:31.199 So getting into a safe in the way that even 1338 01:03:31.280 --> 01:03:35.079 with dedicated inspection, it does not look like anyone was 1339 01:03:35.079 --> 01:03:38.159 ever there. That's kind of the real bread and butter 1340 01:03:38.199 --> 01:03:42.519 of the intelligence community. And that's the scariest thing because 1341 01:03:43.559 --> 01:03:46.760 if you know somebody broke in, you can respond. You 1342 01:03:46.800 --> 01:03:50.280 can either change your security posture going forward, or if 1343 01:03:50.320 --> 01:03:52.599 you had a list of important documents in there, you 1344 01:03:52.639 --> 01:03:55.400 can well, those documents are now compromised. We're not going 1345 01:03:55.480 --> 01:03:57.480 to use those root plans, We're not going to use 1346 01:03:57.519 --> 01:04:03.280 these assets anymore. If somebody in the intelligence world really 1347 01:04:03.360 --> 01:04:06.119 just kind of goes out there and operates in a 1348 01:04:06.159 --> 01:04:07.760 way that isn't easy to detect. 1349 01:04:08.480 --> 01:04:09.679 That's really freaky. 1350 01:04:09.719 --> 01:04:12.679 That's really scary because they could be operating for a 1351 01:04:12.719 --> 01:04:16.679 long time without people reporting the crimes. And it's there 1352 01:04:16.719 --> 01:04:20.760 have been instances where professional technicians. If I'll give you one, 1353 01:04:20.840 --> 01:04:23.239 you mentioned that article for your viewers, I'll try to 1354 01:04:23.239 --> 01:04:23.880 give you one again. 1355 01:04:23.880 --> 01:04:25.480 I don't know. If you do show notes, I'll find it. 1356 01:04:26.039 --> 01:04:30.000 There was a crew of professional safe technicians. I believe 1357 01:04:30.000 --> 01:04:33.320 they operated mostly around the American Southeast, out of Florida 1358 01:04:33.360 --> 01:04:37.440 and other parts of Georgia. They would use general Aviation 1359 01:04:38.280 --> 01:04:40.840 flying VFR. My wife, you know, my wife's almost an 1360 01:04:40.880 --> 01:04:44.079 aspiring pilot and my friend Alyssa's a pilot. Like VFR 1361 01:04:44.199 --> 01:04:46.840 visual flight rules. You don't have to fly all flight plans. 1362 01:04:47.159 --> 01:04:49.519 You can just take your little Cessna or your little 1363 01:04:49.559 --> 01:04:52.440 Piper cub or something and just fly to another city. 1364 01:04:52.880 --> 01:04:55.199 And if you follow you know, the rules of the sky, 1365 01:04:55.360 --> 01:04:57.840 like you're just okay, I'm flying at the right altitude 1366 01:04:57.880 --> 01:05:00.199 and then I land, okay. Radio and these guys we're 1367 01:05:00.239 --> 01:05:04.079 bouncing around to different towns and getting in and getting 1368 01:05:04.119 --> 01:05:06.760 out over the course of a weekend, not staying in 1369 01:05:06.840 --> 01:05:08.840 you know, hotels, or anything like that under their names, 1370 01:05:09.360 --> 01:05:11.760 and it was people couldn't figure out like this is 1371 01:05:11.800 --> 01:05:14.679 like professional safe technician work. And the cops and the 1372 01:05:14.719 --> 01:05:18.800 FBI were looking at lock shops like in that town right, like, 1373 01:05:18.840 --> 01:05:21.239 we're all your employees here. Didn't we take any tools 1374 01:05:21.239 --> 01:05:21.920 home this weekend? 1375 01:05:21.920 --> 01:05:22.440 What happened? 1376 01:05:22.480 --> 01:05:25.679 How is this is professional work? Eventually, eventually they got caught, 1377 01:05:25.719 --> 01:05:29.559 as many criminals do. But yeah, in the government land, 1378 01:05:30.159 --> 01:05:33.119 the idea of that what we would call a clandestine entry. 1379 01:05:34.320 --> 01:05:36.719 Quick bits of terminology for anybody's interested in the forensic 1380 01:05:36.760 --> 01:05:42.480 classifications of things you have overt, covert, surreptitious, and clandestine, 1381 01:05:43.159 --> 01:05:46.159 and these speak to the questions of who will notice 1382 01:05:46.519 --> 01:05:50.440 and how will they notice that something bad has happened overt? 1383 01:05:50.440 --> 01:05:53.440 Anyone can understand, right, if I make a giant hole 1384 01:05:54.000 --> 01:05:57.199 with a wholesaw in a small government filing cabinet that's 1385 01:05:57.199 --> 01:06:00.039 locked up and it's going to the scrap heap, a 1386 01:06:00.159 --> 01:06:02.840 giant freakin' hole and I'm not repairing it, that's very overt. 1387 01:06:03.159 --> 01:06:04.079 Who will notice? 1388 01:06:04.679 --> 01:06:07.360 Anybody will notice with their naked eye, and how will 1389 01:06:07.360 --> 01:06:09.079 they note? They'll just look at it that frings out 1390 01:06:09.079 --> 01:06:13.119 a hole in it. Covert when you talk about covert operations, 1391 01:06:14.320 --> 01:06:17.760 it doesn't mean there's no evidence. It just means that 1392 01:06:17.800 --> 01:06:21.239 someone would not notice the evidence unless they had special training. 1393 01:06:22.079 --> 01:06:25.920 So if I'm leaving small scratches or marks on a 1394 01:06:26.039 --> 01:06:29.039 surface of a door because I was using some hook 1395 01:06:29.079 --> 01:06:33.280 to by pass my way into a room, anybody could 1396 01:06:33.280 --> 01:06:35.800 see that. You don't need magnification, like, oh, look, there's 1397 01:06:35.840 --> 01:06:36.960 some scratches on the latch. 1398 01:06:37.639 --> 01:06:40.360 But unless someone's had special training, it wouldn't put two 1399 01:06:40.360 --> 01:06:42.599 and two together to say, oh, I want those Those 1400 01:06:42.679 --> 01:06:44.639 are not regular wear and tear. That's a that's a 1401 01:06:44.639 --> 01:06:45.719 bypassed latch tool. 1402 01:06:46.199 --> 01:06:49.719 It's a covert entry, surreptitious. Now we get one better. 1403 01:06:50.119 --> 01:06:54.400 Who will notice somebody with training? How will they notice? 1404 01:06:54.960 --> 01:06:58.880 They're specifically looking for it, with investigative techniques, They're not 1405 01:06:58.920 --> 01:07:01.320 just seeing it with the naked eye. They say, all right, 1406 01:07:01.320 --> 01:07:04.239 and let's get the magnifiers out with dust it. Let's 1407 01:07:04.280 --> 01:07:07.079 look inside. That's the forensic locksmithing I'm working. I'm seeing 1408 01:07:07.079 --> 01:07:11.039 signs of surreptitious entry inside of a lock usually, but 1409 01:07:11.199 --> 01:07:14.000 clandestine is the real as the real big one, right, 1410 01:07:14.440 --> 01:07:16.239 that's when who will notice? 1411 01:07:17.000 --> 01:07:22.199 Nobody? How will they notice? They won't you're not leaving 1412 01:07:22.320 --> 01:07:25.480 attributable evidence that points to the nature of the crime 1413 01:07:25.599 --> 01:07:28.239 or points back to you, or if you're you know, 1414 01:07:28.280 --> 01:07:30.000 the government, it doesn't point back to you. 1415 01:07:29.880 --> 01:07:32.360 As a friendly power. You know, it's not like your 1416 01:07:32.519 --> 01:07:35.719 your embassy's not getting a phone call. So that kind 1417 01:07:35.760 --> 01:07:38.360 of skill that is that because if you break into 1418 01:07:38.360 --> 01:07:41.800 a government safe, the value is not, hey, I got 1419 01:07:41.800 --> 01:07:45.320 those secret documents. The real value is we got the 1420 01:07:45.360 --> 01:07:49.199 documents and they don't know that we got them. 1421 01:07:49.280 --> 01:07:52.480 It's interesting because that's not just with safe cracking, but 1422 01:07:53.199 --> 01:07:56.320 that I remember that section in Tool where they had 1423 01:07:56.360 --> 01:07:59.880 all the different package at Defcon, the you know, the 1424 01:08:00.039 --> 01:08:02.239 fool corner. They had all the different. 1425 01:08:01.960 --> 01:08:03.639 Packages, the tamper seals. 1426 01:08:03.719 --> 01:08:06.360 Yeah, the tamper seals and all that stuff, and you 1427 01:08:06.360 --> 01:08:11.199 know people sitting there, you know, just patiently applying like acetoine. 1428 01:08:11.199 --> 01:08:13.400 I don't even know what they use, but you know, 1429 01:08:13.719 --> 01:08:16.199 how do how do I take what's in this box 1430 01:08:16.279 --> 01:08:18.960 out of this box and put all of the you know, 1431 01:08:19.199 --> 01:08:21.880 tamper seals back on the box so nobody knows I 1432 01:08:21.880 --> 01:08:24.000 got in. Fascinating stuff. 1433 01:08:25.560 --> 01:08:28.079 So yeah, yeah, acetone is one of the things you 1434 01:08:28.119 --> 01:08:28.520 would use. 1435 01:08:28.600 --> 01:08:31.920 Yeah, you can use very pure acetone isopropol as popular. 1436 01:08:32.680 --> 01:08:35.520 You'll see the real secret sauce is A is A 1437 01:08:35.720 --> 01:08:37.920 is a non POLYMERA. It's a I'm trying to think 1438 01:08:37.920 --> 01:08:40.000 it's a non polar solvent. It's called end heptane. 1439 01:08:40.319 --> 01:08:42.640 Uh, yeah, that's end. Heaptain does some wild stuff. 1440 01:08:42.640 --> 01:08:44.720 You can you can lift seals off of all kind 1441 01:08:44.760 --> 01:08:47.079 of weird substrates and it doesn't There could be ink 1442 01:08:47.239 --> 01:08:49.880 like serial numbers on the seal and if you smear 1443 01:08:49.920 --> 01:08:52.760 that with acetone, that ink's gonna run right, And heptane 1444 01:08:52.800 --> 01:08:55.760 is lifting solvent that doesn't even smear the ink. 1445 01:08:55.760 --> 01:08:56.640 It's amazing. 1446 01:08:58.960 --> 01:08:59.680 Crazy stuff. 1447 01:08:59.800 --> 01:09:03.359 So let's see to where to pick up on this. 1448 01:09:05.319 --> 01:09:07.520 Where do you want to start? As far as you know, 1449 01:09:07.960 --> 01:09:11.479 Cold War with KGB and CIA trying to break into 1450 01:09:11.560 --> 01:09:13.640 and steal the other secrets. 1451 01:09:15.680 --> 01:09:19.039 Yeah, so that's a great We talked about timelocks and 1452 01:09:19.079 --> 01:09:22.399 how we realized that in the government of military space 1453 01:09:22.640 --> 01:09:24.880 timelocks they ain't it like it's not going to not 1454 01:09:24.920 --> 01:09:27.479 going to do the job. So we've had to develop 1455 01:09:27.920 --> 01:09:32.479 what we thought and many manufacturers touted as manipulation resistant 1456 01:09:32.560 --> 01:09:37.319 or manipulation proof mechanisms, and over the years, the only 1457 01:09:37.439 --> 01:09:42.199 clandestine technique was that very slow methodical manipulation that I 1458 01:09:42.239 --> 01:09:47.520 described just dial manipulation. If you defeat that or make 1459 01:09:47.600 --> 01:09:50.960 it very hard to do, and there's there's mechanical ways 1460 01:09:50.960 --> 01:09:53.000 you can do that. If if any of the listeners 1461 01:09:53.239 --> 01:09:55.840 have ever had a combination lock that they've had to 1462 01:09:56.199 --> 01:09:59.760 enter a combination and then do another thing, twist a 1463 01:09:59.760 --> 01:10:02.119 little what it's called a butterfly knob knob or push 1464 01:10:02.199 --> 01:10:04.600 the dial in or there's it depends on maybe you're 1465 01:10:04.640 --> 01:10:06.800 opening weapons lockers A twenty nine thirty seven or an 1466 01:10:06.840 --> 01:10:10.079 old eighty four hundred series like these were designed to 1467 01:10:10.119 --> 01:10:15.399 prevent manipulation or make manipulation very hard. The intelligence services 1468 01:10:15.520 --> 01:10:17.920 that tried to get around that there there are ways 1469 01:10:17.960 --> 01:10:21.880 to manipulate what are called group one safes the locks 1470 01:10:21.920 --> 01:10:24.079 that it's just so challenging. They said, all right, we 1471 01:10:24.079 --> 01:10:27.319 need a better way, we need we need some other technique. 1472 01:10:27.960 --> 01:10:30.840 What we started to see, and this this is coming 1473 01:10:30.880 --> 01:10:33.279 up around you know, the fifties and really the sixties, 1474 01:10:34.720 --> 01:10:39.399 we started to see the use of radiographic techniques, gamma 1475 01:10:39.439 --> 01:10:43.600 graph methods, where I mean it just it sounds utterly 1476 01:10:43.640 --> 01:10:46.600 bananas when you describe it to people, but the use 1477 01:10:46.760 --> 01:10:52.880 of a high emittance radioactive isotope placed behind or even 1478 01:10:52.920 --> 01:10:57.399 sometimes within the safe mechanism, because on vault bars they 1479 01:10:57.439 --> 01:10:59.279 would do this by making a pinhole in the in 1480 01:10:59.279 --> 01:11:01.800 the doorframes sometimes, or if it's a safe, you could 1481 01:11:01.840 --> 01:11:03.880 just move the safe away from the wall and put 1482 01:11:03.920 --> 01:11:06.520 the radioactive ice toove behind the safe. If they couldn't, 1483 01:11:06.640 --> 01:11:08.760 they would get more isotope and just bring it in 1484 01:11:08.800 --> 01:11:09.520 the next room. 1485 01:11:09.680 --> 01:11:11.359 To'd be like, all right, which go to the next room. 1486 01:11:11.439 --> 01:11:14.800 Just put it over there, and you're putting film like 1487 01:11:14.840 --> 01:11:16.920 you're literally putting an X ray film in front of 1488 01:11:16.960 --> 01:11:20.479 the safe and developing an image to see what's happening 1489 01:11:20.560 --> 01:11:21.560 inside the safe. 1490 01:11:21.399 --> 01:11:24.239 Flock block, and then you have to reverse out. There's 1491 01:11:24.239 --> 01:11:26.560 a whole technique about it. I mentioned this in a 1492 01:11:26.600 --> 01:11:30.079 talk that I gave recently about a team from Poland. 1493 01:11:30.880 --> 01:11:33.279 There's a team they were just called like Division nine, 1494 01:11:33.560 --> 01:11:36.119 like you know, the special Squad number nine. They were 1495 01:11:36.119 --> 01:11:38.439 the Invisible team. In fact, the name of the there's 1496 01:11:38.479 --> 01:11:40.319 a book all about it. It's called Nivid Jumpy. It's 1497 01:11:40.319 --> 01:11:42.199 a book it means invisible. It's in Polish. The whole 1498 01:11:42.199 --> 01:11:45.520 book is in Polish by Thomas Avasovitch. He's a Polish 1499 01:11:45.520 --> 01:11:52.680 investigative journalist. And what Division nine, right, well, a special 1500 01:11:52.680 --> 01:11:57.119 Group Number nine was doing. At the time, Poland was 1501 01:11:57.560 --> 01:11:59.359 part of the Warsaw Pact. They were part of the 1502 01:11:59.359 --> 01:12:02.720 com Block for right, so they were breaking into our 1503 01:12:02.840 --> 01:12:07.199 embassies and our NATO Allies embassies using these techniques. The 1504 01:12:07.239 --> 01:12:10.239 reason we know about it now is because, of course 1505 01:12:10.560 --> 01:12:13.199 Poland is no longer. The Warsaw Pact doesn't exist. Poland 1506 01:12:13.920 --> 01:12:16.359 late in the Cold War, I mean they flipped, right, 1507 01:12:16.439 --> 01:12:18.800 Poland became part of our ally ship and all these 1508 01:12:18.840 --> 01:12:22.119 intelligence operators suddenly were collaborating with us. 1509 01:12:22.680 --> 01:12:24.680 Some of them we would just debrief them. 1510 01:12:24.880 --> 01:12:26.720 Others were people that had to come to the West 1511 01:12:26.720 --> 01:12:29.119 for like medical treatment because they were handling these freakin 1512 01:12:29.159 --> 01:12:30.920 isotopes right, very unsafely. 1513 01:12:31.079 --> 01:12:33.119 Yeah, I was wondering about that. Where they you know, 1514 01:12:33.119 --> 01:12:35.119 because like when you get their X rays, how you 1515 01:12:35.159 --> 01:12:38.119 have to wear the like the you know, the lead thing, 1516 01:12:38.239 --> 01:12:40.399 Like I can't imagine it was good for their health. 1517 01:12:42.279 --> 01:12:42.960 No, it was not. 1518 01:12:43.279 --> 01:12:46.079 And these guys knew that they were taking a hit. 1519 01:12:46.520 --> 01:12:48.840 They wore docimitar badges and such, and some of them knew. 1520 01:12:49.039 --> 01:12:50.600 But they was all for you know, it was their 1521 01:12:50.680 --> 01:12:54.239 job is where they saw it. And even just transporting 1522 01:12:54.279 --> 01:12:58.920 the isotopes around, they kind of rigged up these not 1523 01:12:59.119 --> 01:13:02.159 really safe cans just to make them slightly man portable, 1524 01:13:02.680 --> 01:13:05.399 and they you know, they used just docimiters and other 1525 01:13:06.479 --> 01:13:08.159 measuring devices outside the container. 1526 01:13:08.159 --> 01:13:10.000 They're like, man, these are not these are not doing 1527 01:13:10.039 --> 01:13:11.039 the job. They're not good. 1528 01:13:11.479 --> 01:13:13.920 They'd tell stories about how if they were on long jobs, 1529 01:13:13.960 --> 01:13:16.319 or they would drive from city to city, they would 1530 01:13:16.319 --> 01:13:18.720 put the the isotope in the trunk of one car. 1531 01:13:19.279 --> 01:13:21.159 Thing would be down on his rear leaf springs, like 1532 01:13:21.359 --> 01:13:24.119 this floating steering that was barely on the road, and 1533 01:13:24.159 --> 01:13:26.960 they'd put one guy in the driving that car, and 1534 01:13:27.000 --> 01:13:29.319 everyone else would get in another car like fifty one 1535 01:13:29.399 --> 01:13:32.319 hundred meters behind, and then caravan. And then even on 1536 01:13:32.359 --> 01:13:34.319 long trips they'd stop and they'd rotate people out to 1537 01:13:34.399 --> 01:13:35.319 who's the guy sitting with. 1538 01:13:35.359 --> 01:13:36.640 The isotope in this long drive. 1539 01:13:37.199 --> 01:13:37.439 Wow. 1540 01:13:37.439 --> 01:13:40.600 So yeah, it was not healthy. But for the longest 1541 01:13:40.640 --> 01:13:42.560 time they were doing things that was thought of as 1542 01:13:42.600 --> 01:13:45.920 nothing short of magic, and people could not figure out 1543 01:13:46.079 --> 01:13:49.560 they were bringing these just troves of documents that the 1544 01:13:49.600 --> 01:13:53.119 Intel community in Poland and in Russia and elsewhere. They 1545 01:13:53.119 --> 01:13:55.239 were sending the documents back like, how are you getting 1546 01:13:55.279 --> 01:13:59.239 these documents? What the frigger? You guys are wizards, and yeah, 1547 01:13:59.239 --> 01:14:03.800 they were just they were literally using electronic radiographic techniques 1548 01:14:04.359 --> 01:14:07.399 to image our safe locks and get them open to 1549 01:14:07.439 --> 01:14:09.600 see inside the safe fast. 1550 01:14:09.319 --> 01:14:11.479 And then we figured we figured out something might be up. 1551 01:14:11.960 --> 01:14:14.000 You know, they have their spies just as we have 1552 01:14:14.239 --> 01:14:17.720 our spies elsewhere, and they were trying to source the 1553 01:14:17.760 --> 01:14:22.600 isotopes through various scientific research labs and they had covered 1554 01:14:22.560 --> 01:14:24.479 so why are you buying this cobalt? They would use 1555 01:14:24.520 --> 01:14:28.920 cold or iridium one two, And our people figured out 1556 01:14:28.920 --> 01:14:31.319 there said something something might be up with this? 1557 01:14:31.520 --> 01:14:34.680 With this, I think they are they doing that? Could we? 1558 01:14:34.800 --> 01:14:36.920 And we tried it and we said, oh we can, Yeah, 1559 01:14:36.960 --> 01:14:39.159 this is actually a real thing. So we started making 1560 01:14:39.199 --> 01:14:41.880 safes that would prevent that. And they basically we use 1561 01:14:41.960 --> 01:14:44.039 plastic wheels inside of many of our safes and save 1562 01:14:44.119 --> 01:14:47.359 the plastic wheels and lead shielding. And then they would 1563 01:14:47.359 --> 01:14:49.520 just use different isotopes and there were different techniques that 1564 01:14:49.520 --> 01:14:52.119 were even more dangerous. And yeah, I talk all about 1565 01:14:52.119 --> 01:14:54.359 that in this presentation that I gave in North Carolina 1566 01:14:54.479 --> 01:14:56.039 and in DC not too long ago. 1567 01:14:56.279 --> 01:14:58.640 Are those online? Are those presentations online? 1568 01:14:58.720 --> 01:15:01.119 They are okay, great, they are drop links for you 1569 01:15:01.159 --> 01:15:02.439 and you can share them with others. 1570 01:15:02.520 --> 01:15:06.119 Yeah, we'll put everything that he is talking about. I 1571 01:15:06.600 --> 01:15:09.520 wrote down the name of well Division nine. I'll lays 1572 01:15:09.560 --> 01:15:12.199 get the name of the book from you. You know 1573 01:15:12.279 --> 01:15:14.600 now with Google Translate and you take a picture of 1574 01:15:14.600 --> 01:15:15.560 a piece and read it. 1575 01:15:15.479 --> 01:15:18.560 Like, yeah, I do have I do have a copy 1576 01:15:18.600 --> 01:15:21.479 of the book that I doubt even buy the book 1577 01:15:21.520 --> 01:15:25.840 electronically in Polish. And yeah, you can kind of machine 1578 01:15:25.880 --> 01:15:28.560 translate it. So there's been this machine translated version that 1579 01:15:28.840 --> 01:15:30.760 a bunch of my friends and I we kick it 1580 01:15:30.760 --> 01:15:33.199 around in the intelligence world. It's it's a fascinating read. 1581 01:15:33.560 --> 01:15:36.079 At least one person who saw this, who speaks very 1582 01:15:36.159 --> 01:15:39.159 fluent Polish, he's like, man, I want to do I 1583 01:15:39.199 --> 01:15:41.159 want to do a professional like proper translation. 1584 01:15:41.640 --> 01:15:43.680 Yeah, And I was like, well, Tumash is still he's 1585 01:15:43.680 --> 01:15:45.239 still a journalist. He's still in publication. 1586 01:15:45.600 --> 01:15:47.640 Reach out to the author, tell him enough people, if 1587 01:15:47.760 --> 01:15:49.680 enough people in the United States market, tell him we 1588 01:15:49.720 --> 01:15:51.960 want to read this book, maybe he'll do it an 1589 01:15:51.960 --> 01:15:53.159 official publication of it in. 1590 01:15:53.199 --> 01:15:56.880 English for sure. Yeah, we should get in the publishing business. 1591 01:15:56.920 --> 01:16:00.359 Dan as far as uh, some of the you know, 1592 01:16:00.479 --> 01:16:04.720 things that get stolen. In that Smithsonian article I mentioned, 1593 01:16:04.800 --> 01:16:08.600 you can sort of infer that we're probably trying to 1594 01:16:08.720 --> 01:16:13.199 break into safes and Pakistani embassies for probably trying to 1595 01:16:13.239 --> 01:16:15.000 figure out nuclear strategy stuff. 1596 01:16:15.640 --> 01:16:17.399 That's just my inference from the article. 1597 01:16:18.000 --> 01:16:22.119 There's another interesting report out there that says in nineteen 1598 01:16:22.159 --> 01:16:27.560 fifty eight, the CIA actually accessed the Sputnik satellite that 1599 01:16:27.600 --> 01:16:30.159 the Soviets had put into orbit, and they had access 1600 01:16:30.199 --> 01:16:32.840 to it while it was out on world tour, and 1601 01:16:32.880 --> 01:16:38.039 they had it for three hours to themselves to dismantle, examine, reassemble, 1602 01:16:38.359 --> 01:16:42.239 and then, as you point out, clandestinely replace without anyone 1603 01:16:42.279 --> 01:16:45.720 being the wiser. Interesting case of you know, breaking and 1604 01:16:45.880 --> 01:16:49.600 entering for technological intelligence. 1605 01:16:49.600 --> 01:16:54.720 I guess you could say, m Yeah, that's really cool. 1606 01:16:54.720 --> 01:16:58.159 I never realized that that's really dope. What the heck 1607 01:16:58.239 --> 01:17:00.720 with it? Kat, Were the Soviets just like going out 1608 01:17:00.760 --> 01:17:02.479 to dinner and leaving it into their hotel? What the 1609 01:17:02.520 --> 01:17:03.159 hell were they doing? 1610 01:17:03.279 --> 01:17:06.720 Yeah, they were in the land of the Big p X, 1611 01:17:06.880 --> 01:17:12.119 you know. So apparently it's in a book by Patrick J. 1612 01:17:12.399 --> 01:17:17.399 McGarvey who wrote it a while back, but as far 1613 01:17:17.439 --> 01:17:20.880 as what country that happened in that got redacted by 1614 01:17:20.880 --> 01:17:22.560 the CIA, so we don't know. 1615 01:17:22.920 --> 01:17:27.960 Fascinating, Okay, okay, I mean I imagine that they also 1616 01:17:28.640 --> 01:17:34.399 didn't only take, but probably at times placed or exchanged. Sure, yeah, 1617 01:17:34.680 --> 01:17:38.159 you know when it would it wouldn't be a bad 1618 01:17:38.199 --> 01:17:40.520 idea to have people doing what you want them to 1619 01:17:40.560 --> 01:17:42.680 do when they think it's what they're supposed to be doing. 1620 01:17:46.119 --> 01:17:51.920 So how when did you is this sort of love 1621 01:17:51.960 --> 01:17:53.680 the of the history of it kind of reason for 1622 01:17:53.720 --> 01:17:57.079 you devent or or have you been studying like the 1623 01:17:57.119 --> 01:18:00.479 history of the IC and safe cracking stuff like that 1624 01:18:00.479 --> 01:18:01.159 for quite a while. 1625 01:18:03.640 --> 01:18:07.119 It's something that has grown over time. For me, I 1626 01:18:07.199 --> 01:18:12.239 definitely have done some reading in the past, but this, yeah, 1627 01:18:12.319 --> 01:18:16.199 this latest because the book I mentioned from Thomas Avesovich 1628 01:18:16.600 --> 01:18:18.960 that's only I believe from twenty twenty one or twenty 1629 01:18:19.000 --> 01:18:20.800 twenty two, that was a pandemic read for me. 1630 01:18:22.199 --> 01:18:22.840 Fascinating. 1631 01:18:23.279 --> 01:18:25.840 So what else do you have for us on this topic? 1632 01:18:25.880 --> 01:18:29.079 I've spilled some tea. You have some juicy details about 1633 01:18:29.680 --> 01:18:31.560 intelligence services and safe cracking. 1634 01:18:33.920 --> 01:18:37.880 Well, let's see, I mean, all the locks. 1635 01:18:37.520 --> 01:18:40.840 That we use in the government space nowadays, and I 1636 01:18:40.920 --> 01:18:44.119 touch on this in that same presentation. Anybody who's ever 1637 01:18:44.640 --> 01:18:47.399 worked maybe for a dood contractor or something like that 1638 01:18:47.720 --> 01:18:49.199 you made some of the listeners. 1639 01:18:48.920 --> 01:18:50.079 Maybe be familiar with these. 1640 01:18:50.319 --> 01:18:53.760 They're called electro mechanical safe locks nowadays, where it's not 1641 01:18:53.840 --> 01:18:57.279 a keypad, it is a dial, but there's an electronic 1642 01:18:57.279 --> 01:18:59.359 component in there and you actually have to spin it 1643 01:18:59.399 --> 01:18:59.960 a number of time. 1644 01:19:00.000 --> 01:19:00.880 Time is to spin it. 1645 01:19:00.880 --> 01:19:05.119 Up and to charge it, and then a little numerical 1646 01:19:05.119 --> 01:19:08.079 display will show these are These are safe locks made 1647 01:19:08.119 --> 01:19:10.239 by nowadays they're made by Dorma Kaba. 1648 01:19:10.319 --> 01:19:11.680 The Kaba company is huge. 1649 01:19:12.359 --> 01:19:14.279 It was Kaba Moss for a long time because the 1650 01:19:14.319 --> 01:19:19.479 originating company was Moss Hamilton. The entire story of how 1651 01:19:19.520 --> 01:19:23.000 the Moss Hamilton Safe Company came about and how it 1652 01:19:23.079 --> 01:19:26.880 was proposed as a standard, it gets into a lot 1653 01:19:26.920 --> 01:19:29.479 of if you care about how your tax dollars get 1654 01:19:29.520 --> 01:19:33.079 spent in this country, you know, the the FFL twenty 1655 01:19:33.119 --> 01:19:36.800 seven to forty government lock standard was really pushed by 1656 01:19:36.920 --> 01:19:40.880 a small group of people who designed They came up 1657 01:19:40.920 --> 01:19:43.319 with a new idea for a lock, and then they 1658 01:19:43.920 --> 01:19:47.119 used a lot of political influence to get it accepted 1659 01:19:47.239 --> 01:19:49.960 as a new standard and then they were the that 1660 01:19:50.079 --> 01:19:53.319 was the only lock that qualified under the standard. 1661 01:19:53.640 --> 01:19:55.520 Right, and this for the longest time. 1662 01:19:55.560 --> 01:19:57.880 If many people would be familiar with the name Sergeant 1663 01:19:57.920 --> 01:20:00.119 and Greenleaf, I mean they're a huge name in the 1664 01:20:00.319 --> 01:20:01.279 that safe in lockworld. 1665 01:20:01.319 --> 01:20:03.880 We use those to lock up weapons in the army. 1666 01:20:04.880 --> 01:20:07.760 Yeah, so Sergeant and green Leaf, like they had the 1667 01:20:07.920 --> 01:20:11.119 entire safelock market covered, especially. 1668 01:20:10.720 --> 01:20:11.800 For the government and the army. 1669 01:20:12.720 --> 01:20:15.239 And then this new standard came out and started in 1670 01:20:15.359 --> 01:20:19.119 green Leaf locks didn't comply because only one lock complied, right, 1671 01:20:19.279 --> 01:20:22.840 the one that the designers of the standard made, and 1672 01:20:23.079 --> 01:20:26.600 SNG spent all this effort trying to undermine and figure out, hey, 1673 01:20:26.680 --> 01:20:29.159 how do we get either that product knocked off the 1674 01:20:29.239 --> 01:20:31.720 qualifying products list or how do we get a product 1675 01:20:31.720 --> 01:20:33.399 approved on the qualifying products list? 1676 01:20:34.039 --> 01:20:36.359 And all this inside politicking. 1677 01:20:35.760 --> 01:20:39.680 And inside baseball where these locks were being tested and 1678 01:20:39.720 --> 01:20:43.079 evaluated and found to be faulty, they were found to 1679 01:20:43.119 --> 01:20:48.600 be defeatable, and yeah, just a lot of a lot 1680 01:20:48.600 --> 01:20:51.159 of like senators are involved, making phone calls and a 1681 01:20:51.199 --> 01:20:54.319 lot of lawsuits. In fact, it comes back to Dave, 1682 01:20:54.439 --> 01:20:58.640 Dave mccomi and his you know, his colleagues, Mike Madden 1683 01:20:58.720 --> 01:21:01.399 Mike Madden was He's deal, so he was at Livermore. 1684 01:21:02.159 --> 01:21:02.359 I know. 1685 01:21:02.439 --> 01:21:04.560 I've spoken to Mike about this at length as well, 1686 01:21:05.239 --> 01:21:08.319 and yeah, they they would They were proving, like with experiments, 1687 01:21:08.319 --> 01:21:12.239 they were proving, Hey, this brand new wizbang lock is vulnerable. 1688 01:21:12.520 --> 01:21:14.119 And they did a whole write up about it that 1689 01:21:14.159 --> 01:21:17.039 was going to be published in the trade press, and 1690 01:21:17.079 --> 01:21:20.399 it never saw the line of day because there was 1691 01:21:20.399 --> 01:21:22.560 a lot of threats over lawsuits and and you know, 1692 01:21:23.000 --> 01:21:25.159 to his credit, I really Dave's just a love I 1693 01:21:25.159 --> 01:21:27.119 can't say enough nice things about mister Macomby day. 1694 01:21:27.159 --> 01:21:28.000 Macomby's a great guy. 1695 01:21:28.399 --> 01:21:30.960 He didn't want the main technician who did the was 1696 01:21:30.960 --> 01:21:33.239 paid hired to do the research right. He didn't want 1697 01:21:33.319 --> 01:21:37.840 him to experience ramifications, maybe have his clearance screwed around with, 1698 01:21:38.560 --> 01:21:43.279 So that article was never was never put out. Now 1699 01:21:43.279 --> 01:21:46.840 I've I've read the article, I've seen it. But yeah, 1700 01:21:46.840 --> 01:21:49.039 for the longest time, this was just this rumor. 1701 01:21:49.119 --> 01:21:51.359 Oh have you heard somebody used to mess with that 1702 01:21:51.560 --> 01:21:54.039 exo lock? Nah, that didn't It happened. 1703 01:21:54.039 --> 01:21:56.560 It absolutely happened, and none of these locks have ever 1704 01:21:56.560 --> 01:21:58.840 been removed from the qualified products list. To this day, 1705 01:21:59.199 --> 01:22:03.359 I still find the original original lock, the EXO seven 1706 01:22:03.399 --> 01:22:05.920 it was called. It is still in the field on 1707 01:22:06.039 --> 01:22:10.079 some containers props for long life span. Right, it's way 1708 01:22:10.119 --> 01:22:14.119 beyond their originally anticipated duty cycle, but they're still out there. 1709 01:22:14.119 --> 01:22:17.800 They're still in use locking up materials to this day. 1710 01:22:18.079 --> 01:22:21.680 Well, it's interesting that that sort of reflects what you 1711 01:22:21.760 --> 01:22:24.199 and the other instructors and the people at Defcon and 1712 01:22:24.239 --> 01:22:28.800 black Hat teach on the hacker electronic digital side, that 1713 01:22:28.920 --> 01:22:31.960 everyone claims their stuff is secure, but it really isn't 1714 01:22:32.199 --> 01:22:33.800 and a lot of these companies kind of try to 1715 01:22:33.800 --> 01:22:36.640 whitewash that or gloss over it and pretend it's not happening. 1716 01:22:36.640 --> 01:22:39.079 And it's interesting to see the parallel in the physical 1717 01:22:39.079 --> 01:22:40.239 security world as well. 1718 01:22:43.039 --> 01:22:47.319 Yeah, it's I really do wish that more companies operated 1719 01:22:47.359 --> 01:22:50.680 in the way that finally software and network security companies 1720 01:22:50.720 --> 01:22:55.359 do now with you know, bug bounty programs and willingness 1721 01:22:55.399 --> 01:22:58.800 to engage with researchers and do which would nowadays be 1722 01:22:58.840 --> 01:23:02.520 called a coordinated disc closure where the researcher gets to 1723 01:23:02.560 --> 01:23:05.319 put out a paper but only after the threat they 1724 01:23:05.359 --> 01:23:07.920 have found has been mitigated properly, and they even oftentimes 1725 01:23:07.920 --> 01:23:10.960 the researchers will work with these vendors that have these programs, 1726 01:23:11.000 --> 01:23:13.479 they'll say, all right, let's collaborate, let's keep you under 1727 01:23:13.560 --> 01:23:16.399 NDA until we get it fixed, and then you get 1728 01:23:16.399 --> 01:23:18.760 the credit and the fame and the recognition for your 1729 01:23:18.760 --> 01:23:22.199 hard work, and the public is made safer both in 1730 01:23:22.239 --> 01:23:24.119 the short term by not disclosing it in a long 1731 01:23:24.199 --> 01:23:27.640 term by everyone getting to upgrade and getting a new version. 1732 01:23:28.319 --> 01:23:31.119 We don't see that nearly as much with the physical 1733 01:23:31.279 --> 01:23:34.880 mechanical world, because you know, if a software package has 1734 01:23:34.880 --> 01:23:37.720 a bug, they fix it and they say all right, 1735 01:23:38.239 --> 01:23:42.680 download version fourteen point six. You download it on the internet, 1736 01:23:42.720 --> 01:23:46.000 you click okay install. If a safe lock has found 1737 01:23:46.000 --> 01:23:48.039 out a bug or I mean we saw this with 1738 01:23:48.079 --> 01:23:51.359 hotel doors, right, Lots of things have been done in 1739 01:23:51.399 --> 01:23:53.760 the hotel doors back when it was I think Cody 1740 01:23:53.760 --> 01:23:57.279 Brocious did the ondity locks a long time ago with 1741 01:23:57.319 --> 01:23:59.920 like a little like in Arduino that he made some 1742 01:24:00.079 --> 01:24:02.720 code on. And then there were some kids very recently 1743 01:24:02.800 --> 01:24:06.800 the Salto product the safe lock, which they call the 1744 01:24:07.000 --> 01:24:11.079 unsafe lock when they did their Defcon presentation. These are 1745 01:24:11.239 --> 01:24:14.800 products where the researchers work with some vendors, but like 1746 01:24:14.960 --> 01:24:18.720 the fix is some technician going around to like every 1747 01:24:18.800 --> 01:24:23.079 freaking door, and like installing a hardware flash, and hotels 1748 01:24:23.119 --> 01:24:25.640 across the country like having to rotate out all of 1749 01:24:25.680 --> 01:24:28.520 their keys, like their their card stock that they have 1750 01:24:28.600 --> 01:24:30.640 a big box of Like, nope, you got to throw 1751 01:24:30.640 --> 01:24:31.479 that card stock away. 1752 01:24:31.520 --> 01:24:33.199 We need new silicon inside those room keys. 1753 01:24:33.720 --> 01:24:37.000 So the lift is so much more to make an 1754 01:24:37.079 --> 01:24:40.039 upgrade in the physical world that a lot of vendors 1755 01:24:40.239 --> 01:24:42.760 still want to play the no. 1756 01:24:42.560 --> 01:24:44.199 No, no, no, don't. I don't I didn't hear that. 1757 01:24:44.680 --> 01:24:45.760 No, I don't want to know. 1758 01:24:45.800 --> 01:24:47.159 There's a problem, right game. 1759 01:24:47.560 --> 01:24:51.239 Well, I mean it's all it's all money. Then they don't. 1760 01:24:51.479 --> 01:24:51.680 You know. 1761 01:24:52.199 --> 01:24:54.560 It reminds me of sort of like vehicle you know, 1762 01:24:54.760 --> 01:24:59.439 car recalls, vehicle recalls. You know, it's it's a numbers game. 1763 01:24:59.479 --> 01:25:02.479 It's like how much money will this cost us, not 1764 01:25:02.960 --> 01:25:06.439 how many people will we save? And so I imagine 1765 01:25:06.560 --> 01:25:10.000 for you know, for a physical security company, it's the 1766 01:25:10.000 --> 01:25:12.319 same thing. It's like, we don't care if you can 1767 01:25:12.359 --> 01:25:15.359 defeat our locks as long as not everybody knows about it, 1768 01:25:15.680 --> 01:25:21.039 right and and you know, uh, yeah, that's it's it's sad, 1769 01:25:21.159 --> 01:25:23.760 it's it's scary. What what are some of the things, 1770 01:25:23.760 --> 01:25:26.439 you know, it brings us back to go ahead, no, please, 1771 01:25:27.560 --> 01:25:27.880 go ahead. 1772 01:25:28.279 --> 01:25:30.399 It brings us back and recalling ed Norton. We mentioned 1773 01:25:30.520 --> 01:25:34.199 Edward Norton in the movie The Score. He was also 1774 01:25:34.359 --> 01:25:38.439 in uh, the movie adaptation of the Chuck Nax's book 1775 01:25:38.600 --> 01:25:41.239 Fight Club. Right, there's that line he's talking to someone 1776 01:25:41.279 --> 01:25:43.359 on an airplane in the movie and he says, I 1777 01:25:43.439 --> 01:25:47.279 work for a major actuarial insurance firm, and. 1778 01:25:46.680 --> 01:25:48.479 And he talks he's literally he talks about the formula. 1779 01:25:48.640 --> 01:25:50.800 He's like, if there's a certain model of car and 1780 01:25:50.840 --> 01:25:53.720 the brakes fail and people can die in a car. Right, 1781 01:25:53.720 --> 01:25:55.439 we do the math of how many times it would happen, 1782 01:25:55.479 --> 01:25:58.439 what's the average payout in a wrongful death lawsuit? 1783 01:25:58.560 --> 01:26:00.359 And if it costs more than the Yeah, we're not 1784 01:26:00.359 --> 01:26:00.960 going to recall the. 1785 01:26:00.880 --> 01:26:05.479 Breaks, right, Yeah. What are some of the things, you know, 1786 01:26:05.479 --> 01:26:07.520 you've talked about some of these locks that are still 1787 01:26:07.520 --> 01:26:11.239 out there in service and hotel doors. What are some 1788 01:26:11.319 --> 01:26:15.680 of the things that you see, whether it's government buildings 1789 01:26:16.119 --> 01:26:20.640 or commercial buildings that aren't like a failing of the 1790 01:26:20.680 --> 01:26:27.840 actual hardware, but that they do like consistently that defeats 1791 01:26:27.840 --> 01:26:30.359 their own security. And then on the personal side, what do. 1792 01:26:30.479 --> 01:26:32.560 What do you see people do with their own homes 1793 01:26:32.880 --> 01:26:36.720 or whatever? That is also sort of this repeatable offense. 1794 01:26:39.359 --> 01:26:41.800 Sure, two very different sort of answers. 1795 01:26:41.840 --> 01:26:45.520 There one thing that I see a lot of, and 1796 01:26:45.680 --> 01:26:47.520 all of my colleagues would probably also say this is 1797 01:26:47.520 --> 01:26:53.319 sort of improper installation, or two different systems that are 1798 01:26:53.880 --> 01:26:58.279 not ever tested together. For example, I will mention that 1799 01:26:58.560 --> 01:27:00.640 I do a lot of things with fires and fire 1800 01:27:00.680 --> 01:27:05.399 in life safety. If you're ever in a building, especially 1801 01:27:05.439 --> 01:27:08.119 if you're in hotels, if you're in a corporate commercial space. 1802 01:27:09.119 --> 01:27:12.039 The next time you're passing through a door and opening, 1803 01:27:12.159 --> 01:27:15.239 if it's a kind of a heavy door, look at 1804 01:27:15.359 --> 01:27:18.880 the hinge side of the doorframe and the door itself, 1805 01:27:18.920 --> 01:27:20.880 the little butt side of the door, and you might 1806 01:27:20.920 --> 01:27:23.920 see a metal or foil sticker. These are called door 1807 01:27:23.960 --> 01:27:26.800 lay they're labeled door assemblies. These are for fire doors. 1808 01:27:27.800 --> 01:27:31.039 A fire door if it has a certain endurance rating 1809 01:27:31.239 --> 01:27:35.279 of forty five minutes, one hour, two hours. The entire 1810 01:27:35.359 --> 01:27:40.560 assembly is tested together, so you'll have you name who's 1811 01:27:40.560 --> 01:27:43.159 making the door, true door products and something. They make 1812 01:27:43.199 --> 01:27:45.640 a whole door assembly, and then that gets sent off 1813 01:27:45.960 --> 01:27:49.760 to a big testing lab. Warnock, Hersy or intertech or 1814 01:27:49.840 --> 01:27:54.079 underwriter's lab something like that. They will test the entire 1815 01:27:54.199 --> 01:27:56.520 door and the door frame and the hinge, all these 1816 01:27:56.520 --> 01:27:59.640 components together, and they'll literally put it in a furnace 1817 01:27:59.640 --> 01:28:01.439 and they'll hit it with a hose stream test to 1818 01:28:01.439 --> 01:28:04.479 see if it bows or breaks or pops open. And 1819 01:28:04.520 --> 01:28:06.279 then it is you know, blessed and approved. It gets 1820 01:28:06.279 --> 01:28:09.560 a labeled rating. But that is how it is done 1821 01:28:09.560 --> 01:28:11.359 this way with the fact, and you can make any 1822 01:28:11.359 --> 01:28:13.439 modifications in the field. In fact, that's one of the 1823 01:28:13.439 --> 01:28:16.239 things we inspect for and look for our field modifications. 1824 01:28:16.520 --> 01:28:19.560 Did somebody add access control to this door? Did they 1825 01:28:19.600 --> 01:28:21.359 punch a hole in the doorframe and then there's the 1826 01:28:21.399 --> 01:28:22.439 door sensor in there. 1827 01:28:23.359 --> 01:28:25.520 Well, now you violated the integrity of the doorframe. What 1828 01:28:25.520 --> 01:28:25.920 are you doing? 1829 01:28:25.960 --> 01:28:26.279 You can't. 1830 01:28:26.359 --> 01:28:28.880 You have to use fire rated parts to that. 1831 01:28:29.680 --> 01:28:33.520 So we see a lot of security systems where that 1832 01:28:33.680 --> 01:28:36.960 door lock that you might have bought was designed properly, 1833 01:28:37.079 --> 01:28:40.079 worked well, went through all of its testing, and then 1834 01:28:40.159 --> 01:28:40.880 you install that. 1835 01:28:41.119 --> 01:28:42.640 But then somebody else comes along, some. 1836 01:28:42.600 --> 01:28:46.520 Integrators installing an access control panel, and then they are 1837 01:28:46.560 --> 01:28:48.159 we're going to run wires, so we'll put an access 1838 01:28:48.159 --> 01:28:52.199 control electronic door latch well, now you've taken away the 1839 01:28:52.239 --> 01:28:54.920 strike plate that came with the door lock, and you're 1840 01:28:55.000 --> 01:28:57.720 using a different type of strike mechan an electronics strike 1841 01:28:58.359 --> 01:29:02.520 and those two components were never tested together. So installation 1842 01:29:02.680 --> 01:29:06.239 of disparate products that were never tested together, they will 1843 01:29:06.279 --> 01:29:09.359 not perform the way they were designed to perform. 1844 01:29:09.920 --> 01:29:13.159 We see that all the time because and the world 1845 01:29:13.199 --> 01:29:15.119 is a big complicated place. I get it. 1846 01:29:15.520 --> 01:29:18.479 You know, your door hardware parts guy is not the 1847 01:29:18.520 --> 01:29:23.039 one manufacturing your access control card technology system and the 1848 01:29:23.079 --> 01:29:26.640 card system like NXP Semiconductor is not out there making 1849 01:29:26.680 --> 01:29:30.720 door latches. So I understand the problems. But that's why 1850 01:29:31.520 --> 01:29:35.039 we love it. We absolutely love it. When we've had 1851 01:29:35.439 --> 01:29:38.840 people in RTA classes that aren't penetration team members. 1852 01:29:38.880 --> 01:29:41.960 We've had integrators and installers come to our classes and 1853 01:29:42.079 --> 01:29:44.479 they it's open their eyes, like, oh my god. We 1854 01:29:44.560 --> 01:29:45.399 do that all the time. 1855 01:29:46.039 --> 01:29:48.760 Yeah, we've been undermining the security to the customers, and 1856 01:29:49.039 --> 01:29:51.760 you know, the customers insisting we want these parts because 1857 01:29:51.760 --> 01:29:54.479 they look good, and you don't want to know, don't 1858 01:29:54.560 --> 01:29:56.800 change out the other thing that will not the nice 1859 01:29:56.840 --> 01:29:59.640 sat and finish keep that on the door, but then 1860 01:29:59.680 --> 01:30:01.600 just change is this part of the door and now 1861 01:30:01.600 --> 01:30:03.399 these guys come away from us like, man, I'm not 1862 01:30:03.399 --> 01:30:04.199 gonna do that anymore. 1863 01:30:04.720 --> 01:30:05.199 So. 1864 01:30:05.199 --> 01:30:07.520 So and as far as what people do in a 1865 01:30:07.560 --> 01:30:09.000 resident okay, go ahead, please. 1866 01:30:08.880 --> 01:30:10.880 No, I was gonna say, so you're not like you. 1867 01:30:10.880 --> 01:30:15.399 You're The example you gave was how it reduces it's 1868 01:30:15.560 --> 01:30:20.840 it's longevity in a fire setting. But you're also saying 1869 01:30:21.159 --> 01:30:23.279 that when they come in and you know, make a 1870 01:30:23.359 --> 01:30:26.720 convenience change like an electric clock or an access panel 1871 01:30:26.760 --> 01:30:31.600 or whatever, it also gives you an easier ways to 1872 01:30:31.680 --> 01:30:32.640 beat those systems. 1873 01:30:34.760 --> 01:30:38.439 Oh yeah, because they're installing the one like, well, I 1874 01:30:38.439 --> 01:30:41.640 did my job correctly, but you don't realize you've installed 1875 01:30:41.640 --> 01:30:44.199 it in a manner that it wasn't designed to be 1876 01:30:44.239 --> 01:30:46.520 installed it or it was. Now it's trying to interact 1877 01:30:46.600 --> 01:30:48.680 with a different system that you've never tested it on. 1878 01:30:49.199 --> 01:30:51.439 So we'll say, oh wow, when you put those two 1879 01:30:51.239 --> 01:30:53.640 two two great tastes, they don't taste great together because 1880 01:30:53.640 --> 01:30:55.720 it's very vulnerable now that you bolted this onto that 1881 01:30:55.800 --> 01:30:57.239 and it doesn't work the way you think it does. 1882 01:30:57.439 --> 01:31:02.119 Yeah, I have Well, I guess one more question before 1883 01:31:02.159 --> 01:31:05.119 we go on to viewer questions, which I'd like to 1884 01:31:05.159 --> 01:31:09.399 ask since Thief came out in nineteen eighty one. What 1885 01:31:09.479 --> 01:31:12.840 has made safe cracking more difficult? What has changed in 1886 01:31:12.880 --> 01:31:17.399 this field in the last forty years or so that 1887 01:31:17.560 --> 01:31:20.560 is making whether it's our intelligence service professionals or people 1888 01:31:20.640 --> 01:31:23.760 like you helping out. You know, the government decommissioned safes. 1889 01:31:24.039 --> 01:31:26.279 What are the big changes that have occurred over the 1890 01:31:26.359 --> 01:31:27.319 last few decades. 1891 01:31:29.920 --> 01:31:33.680 Oh, yeah, it's interesting, it'll tie back into the previous 1892 01:31:33.760 --> 01:31:35.800 you'd asked one question we almost might have missed. 1893 01:31:35.840 --> 01:31:37.399 He said, what can people do at home? 1894 01:31:37.960 --> 01:31:40.600 And it is the same answer as what has changed 1895 01:31:40.640 --> 01:31:42.800 with safe cracking? And it's the same answer that it's 1896 01:31:42.840 --> 01:31:44.439 a call all the way back to I was saying. 1897 01:31:44.439 --> 01:31:47.359 When we were younger, we had more free space to 1898 01:31:47.439 --> 01:31:48.520 kind of play and roam. 1899 01:31:49.399 --> 01:31:51.600 It's all electronic monitoring. 1900 01:31:52.600 --> 01:31:57.520 Nowadays, you're not going to see beautiful, amazing graffiti on 1901 01:31:57.600 --> 01:32:01.279 a subway car because kids in New York City in 1902 01:32:01.319 --> 01:32:03.239 the seventies and eighties, I mean, they could sneak around 1903 01:32:03.279 --> 01:32:06.119 in tunnels all night long and there may be would 1904 01:32:06.159 --> 01:32:10.720 be one cop with a flashlight who might catch them. Nowadays, 1905 01:32:10.960 --> 01:32:13.600 you try to go somewhere you don't belong. In Manhattan's 1906 01:32:13.640 --> 01:32:16.520 MTA you're gonna be caught in five seconds. There's going 1907 01:32:16.560 --> 01:32:19.840 to be electronic co there's cameras everywhere nowadays. What makes 1908 01:32:19.840 --> 01:32:22.640 safe cracking hard the idea of like there was a 1909 01:32:22.680 --> 01:32:25.880 famous robbery I even if I can find the article 1910 01:32:25.960 --> 01:32:28.520 or any footage of it, there was literally like all 1911 01:32:28.640 --> 01:32:32.079 the strong boxes are ripped out of this huge nest 1912 01:32:32.520 --> 01:32:34.880 of safe deposit boxes inside of a vault. 1913 01:32:35.319 --> 01:32:37.479 And I think it might have been in Brussels. 1914 01:32:37.600 --> 01:32:41.600 It was a big financial and precious goods imporium and 1915 01:32:41.640 --> 01:32:45.000 these these people had literally concrete cored through the wall 1916 01:32:45.760 --> 01:32:50.039 and they spent the whole weekend rating this entire vault 1917 01:32:50.760 --> 01:32:52.960 because there was no electronic monitoring, There were no cameras, 1918 01:32:52.960 --> 01:32:54.960 there was no alarms down there because who would ever 1919 01:32:55.039 --> 01:33:00.600 get in. Nowadays electronics have gotten so cheap, just electronic 1920 01:33:00.640 --> 01:33:01.479 monitoring on everything. 1921 01:33:01.640 --> 01:33:03.720 Now, I'm not saying you can't defeat it, it's different. 1922 01:33:03.720 --> 01:33:04.880 I mean, we have a whole we. 1923 01:33:04.880 --> 01:33:07.960 Have a whole intrusion detection defeats class at r TA right. 1924 01:33:08.039 --> 01:33:10.880 Well, but if those gangs are doing it now, the 1925 01:33:10.920 --> 01:33:12.960 gangs are doing it now too, with those portable man 1926 01:33:13.000 --> 01:33:18.000 packs that they're getting off or whatever. But anyway, but but, but. 1927 01:33:18.279 --> 01:33:19.960 Yes, they're monitoring yourself. 1928 01:33:20.000 --> 01:33:21.760 Like if I can go up to your safe over 1929 01:33:21.800 --> 01:33:24.279 the weekend, if you're away on a fishing trip or something, 1930 01:33:24.680 --> 01:33:26.359 and I can just spend all weekend in your house 1931 01:33:26.399 --> 01:33:29.680 working on your safe, something's wrong, right, Like, come on, 1932 01:33:30.840 --> 01:33:35.119 use use a half decent electronic home monitoring solution telling 1933 01:33:35.119 --> 01:33:37.640 you some pile of poo, like simply safe or something. 1934 01:33:37.960 --> 01:33:38.720 Use something good. 1935 01:33:40.399 --> 01:33:42.600 I like, Ubiquity is a pretty good brand. I don't 1936 01:33:42.600 --> 01:33:44.359 really like Nest and ring Brim, and we're not going 1937 01:33:44.439 --> 01:33:46.439 to get it bagging on or promoting any brands. I 1938 01:33:46.479 --> 01:33:47.760 don't work for any these companies, don't. 1939 01:33:47.760 --> 01:33:48.079 They don't. 1940 01:33:48.239 --> 01:33:51.439 I don't have grudges of it. But using electronic monitoring 1941 01:33:52.199 --> 01:33:55.600 and using it effectively, that's what makes everything so much harder. 1942 01:33:56.319 --> 01:33:57.760 Electronic intrusion detection. 1943 01:33:58.520 --> 01:34:03.479 Yeah, it's fascinating so for for people who might want 1944 01:34:03.520 --> 01:34:08.000 to get into this field, right, whether because whether it's 1945 01:34:08.760 --> 01:34:11.399 you know, doing what you do, uh sort of more 1946 01:34:11.399 --> 01:34:14.000 in the civilian market with you know, obviously government stuff, 1947 01:34:14.279 --> 01:34:16.920 or if they want to be a black bag guy 1948 01:34:17.000 --> 01:34:19.640 or gal you know, working for the you know, FBI 1949 01:34:19.880 --> 01:34:22.520 or the CIA or you know, local PD or whatever. 1950 01:34:23.119 --> 01:34:25.960 Where do they start. What does that career path look like? 1951 01:34:26.319 --> 01:34:28.000 There's not a military MS for it? 1952 01:34:28.119 --> 01:34:31.199 So right, that is true. That is true. 1953 01:34:31.279 --> 01:34:35.199 Although we're so self you hope you don't think I'm 1954 01:34:35.199 --> 01:34:36.039 sounding self serving. 1955 01:34:36.079 --> 01:34:39.000 I mentioned not at our training. Yes we are. 1956 01:34:39.039 --> 01:34:42.119 We are inches away from I believe, being what is 1957 01:34:42.159 --> 01:34:46.399 called cool program certified. The cool The cool program is 1958 01:34:46.720 --> 01:34:49.199 people who are I think it's your last six months 1959 01:34:49.239 --> 01:34:54.000 of service or recently exited uniform. There is budget available 1960 01:34:54.039 --> 01:34:55.960 through the d D for people who want to train 1961 01:34:56.039 --> 01:34:56.600 for a new career. 1962 01:34:56.800 --> 01:34:57.600 That's fantastic. 1963 01:34:57.920 --> 01:35:02.319 So coming to us or I think Blockmasters and Mark 1964 01:35:02.359 --> 01:35:05.800 Baits MBA USA, I think they might also be Cool 1965 01:35:05.800 --> 01:35:09.720 Program compliant. So if you're not in uniform, if you're 1966 01:35:09.760 --> 01:35:12.479 just in the civilian land, that's fine. But it really 1967 01:35:12.560 --> 01:35:16.680 is showing up and getting some base level of training, 1968 01:35:17.359 --> 01:35:22.520 not only to know what the landscape is, but a 1969 01:35:22.520 --> 01:35:24.319 lot of times and I have a whole blog post 1970 01:35:24.359 --> 01:35:28.159 about this, I'll throw you that link as well. People 1971 01:35:28.319 --> 01:35:31.239 like to bag on training. The training doesn't prove you 1972 01:35:31.279 --> 01:35:33.640 actually know how to do a thing. I've seen more 1973 01:35:33.680 --> 01:35:37.079 people with a certification that they didn't know squat. 1974 01:35:38.279 --> 01:35:39.000 That's true. 1975 01:35:39.199 --> 01:35:42.159 I've known many people with college degrees that aren't working 1976 01:35:42.199 --> 01:35:45.119 in the field that they got a degree in. But 1977 01:35:45.199 --> 01:35:47.920 you know what a certification, like with training and ultimately 1978 01:35:47.920 --> 01:35:52.279 getting a certification represents to a lot of employers. It 1979 01:35:52.359 --> 01:35:59.279 represents that you can sit the f down and just 1980 01:35:59.640 --> 01:36:04.159 complet something, which is a very hard thing for a 1981 01:36:04.239 --> 01:36:07.960 lot of people out there to do. Yes, a certification 1982 01:36:08.279 --> 01:36:11.119 doesn't necessarily mean you're the best person at what the 1983 01:36:11.119 --> 01:36:13.600 piece of paper says you can do, but it means 1984 01:36:13.720 --> 01:36:18.880 you can see a task through to completion. In our 1985 01:36:19.000 --> 01:36:24.039 scatterbrained ADHD world, a lot of times employers today just 1986 01:36:24.119 --> 01:36:27.199 want to know are you a reliable person? Can you 1987 01:36:27.479 --> 01:36:31.039 take a task and run with it and see it through? 1988 01:36:32.079 --> 01:36:34.760 So I like to remind people of that when they say, man, 1989 01:36:35.319 --> 01:36:37.399 is this certification going to actually help me out in 1990 01:36:37.439 --> 01:36:41.079 my career? Yeah, it's much in the same way that 1991 01:36:41.119 --> 01:36:43.279 you mentioned people in the service, right, A lot of 1992 01:36:43.279 --> 01:36:45.680 times if an employer sees somebody, he said, oh, this 1993 01:36:45.720 --> 01:36:48.680 person's former Army, this person was air Force, and they 1994 01:36:48.760 --> 01:36:50.680 might give them like, let's bring that resume to the 1995 01:36:50.720 --> 01:36:54.560 top of the pile. It's not because the job they're 1996 01:36:54.600 --> 01:36:56.760 going to do has anything to do with you. 1997 01:36:56.800 --> 01:36:59.800 Know, liberating some foreign bill. It has to do with 1998 01:36:59.840 --> 01:37:00.000 the thing. 1999 01:37:00.279 --> 01:37:03.439 This person knows how to like keep their heads straight 2000 01:37:03.600 --> 01:37:08.399 in pressure. This person knows how to execute on tasks. 2001 01:37:08.439 --> 01:37:10.279 This person can self manage. 2002 01:37:10.920 --> 01:37:15.920 So giving employers a shorthand way of evaluating, Yeah, I'm 2003 01:37:15.960 --> 01:37:18.319 not going to be a drag in your organization. I 2004 01:37:18.439 --> 01:37:20.880 kind of can tie my own shoes and get myself 2005 01:37:20.880 --> 01:37:24.399 to Friday without you having to babysit me. That's valuable 2006 01:37:24.399 --> 01:37:26.000 to what a lot. That's what a lot of companies want. 2007 01:37:26.039 --> 01:37:28.079 They want to be able to quickly ascertain. Are you 2008 01:37:28.119 --> 01:37:29.880 a person that's going to bring value to my org? 2009 01:37:30.279 --> 01:37:30.520 Right? 2010 01:37:31.279 --> 01:37:31.439 Right? 2011 01:37:31.560 --> 01:37:34.880 If you got the Patreon questions, absolutely, And I apologize 2012 01:37:34.880 --> 01:37:37.720 for those text rings. It's I had taken my phone 2013 01:37:37.880 --> 01:37:39.840 off airplane modes like a lot. 2014 01:37:39.960 --> 01:37:40.640 I didn't hear them at all. 2015 01:37:40.640 --> 01:37:45.760 It's all okay, great, great, great, let's see her. Let 2016 01:37:45.760 --> 01:37:46.880 me take my phone off. 2017 01:37:50.640 --> 01:37:52.399 You're getting these live and we've been live streaming this 2018 01:37:52.439 --> 01:37:54.039 whole time for. 2019 01:37:54.119 --> 01:37:57.840 The Patreon folks people watching. 2020 01:37:58.279 --> 01:37:59.880 We used to, man, I feel. 2021 01:37:59.640 --> 01:38:01.239 So bad that we were. We were a little bit 2022 01:38:01.279 --> 01:38:02.880 off kilter on getting the zoom link work. 2023 01:38:02.880 --> 01:38:06.279 And no, it's more my fault than anything. 2024 01:38:07.000 --> 01:38:11.560 Okay, so matt As, thank you much. Really stoked to 2025 01:38:11.600 --> 01:38:14.319 see Devian all on a guess huge in the pent 2026 01:38:14.359 --> 01:38:17.880 testing community. Question for the guests, what is one tool 2027 01:38:18.039 --> 01:38:20.399 that you see people include in their physical pen test 2028 01:38:20.520 --> 01:38:23.560 kit that is overrated and should probably be left at home? 2029 01:38:24.119 --> 01:38:26.680 And what is one tool you always bring with you 2030 01:38:26.800 --> 01:38:27.640 on an engagement? 2031 01:38:28.920 --> 01:38:31.520 Oh? I love the first question. 2032 01:38:31.640 --> 01:38:34.840 I want to give more brain space to that because 2033 01:38:35.560 --> 01:38:38.920 people buy so much stuff and keep adding it to 2034 01:38:39.000 --> 01:38:42.560 their kit and adding it to their kit. And yeah, 2035 01:38:42.800 --> 01:38:45.239 you know, you see the person like my daily pocket carry, 2036 01:38:45.279 --> 01:38:47.239 then that becomes their sort of sling bag, right, and 2037 01:38:47.239 --> 01:38:49.039 then that becomes a backpack right. 2038 01:38:49.239 --> 01:38:51.319 Before you know it. You're like, it's not even daily 2039 01:38:51.359 --> 01:38:52.760 carrying or what do you what do you freaking do 2040 01:38:52.800 --> 01:38:56.880 and you're carrying a freaking rut bag? What would I say? 2041 01:38:57.319 --> 01:39:00.560 You know what I'm gonna go. Here's what I'm gonna do. 2042 01:39:00.920 --> 01:39:03.880 I'm actually going to pull up, briefly, my own you know, 2043 01:39:03.880 --> 01:39:05.680 I'm gonna pull up Red Team Tools, which is my 2044 01:39:05.760 --> 01:39:08.640 own catalog, and I'm going to look through my own 2045 01:39:08.720 --> 01:39:11.159 catalog about something of like, this is the last thing 2046 01:39:11.520 --> 01:39:13.479 you should possibly purchase from us. 2047 01:39:15.359 --> 01:39:16.239 Bump cocade. 2048 01:39:16.399 --> 01:39:20.119 Some of these are all right, it's probably it might 2049 01:39:20.159 --> 01:39:28.000 be an electronic tool. Yeah, yeah, you know what I 2050 01:39:28.039 --> 01:39:30.359 will say, it's a it's a cool it's a cool thing. 2051 01:39:31.119 --> 01:39:34.039 But we have a couple of tools designed for pin 2052 01:39:34.159 --> 01:39:37.760 pad hacking. There are people that say you can use 2053 01:39:37.880 --> 01:39:41.760 thermal cameras to like look at a pin pad right 2054 01:39:41.760 --> 01:39:43.439 after somebody has entered a pin to see where their 2055 01:39:43.479 --> 01:39:46.560 fingers were touching. We actually, I make a kit of 2056 01:39:46.760 --> 01:39:49.279 UV powder, so you dust the pin and you come 2057 01:39:49.319 --> 01:39:51.880 back later with a UV light and you can see 2058 01:39:52.239 --> 01:39:53.760 where the pin pad was touched. 2059 01:39:55.000 --> 01:39:57.399 I know, we sell them like I make these like. 2060 01:39:57.319 --> 01:40:02.279 My that's Hollywood shit, man, Come on, Like, I'm not 2061 01:40:02.319 --> 01:40:05.079 saying it has no purpose. And in fact, if you 2062 01:40:05.159 --> 01:40:10.720 have an electronics safe, that's interesting because that's probably one code, 2063 01:40:11.039 --> 01:40:14.600 or an alarm panel, that's probably one code that gets entered. 2064 01:40:15.239 --> 01:40:18.640 But a door, an electronic keypad access door where there's 2065 01:40:18.640 --> 01:40:22.319 probably lots of people with different codes, that's not gonna help. 2066 01:40:22.720 --> 01:40:24.640 Come on, you're not going to get there. 2067 01:40:24.960 --> 01:40:27.760 But yeah, I have used it on an electronics safe 2068 01:40:27.800 --> 01:40:31.359 in an executive's office once because I was able to see. 2069 01:40:31.199 --> 01:40:32.119 Which numbers they had touched. 2070 01:40:32.119 --> 01:40:34.479 And I came back a week later, and I didn't 2071 01:40:34.479 --> 01:40:37.000 actually open the safe worn off, but I said, is 2072 01:40:37.000 --> 01:40:39.159 that are these the digits of your combination. I didn't 2073 01:40:39.159 --> 01:40:41.119 even tell him what the digits the right order. He 2074 01:40:41.199 --> 01:40:42.720 was freaked out that I actually knew it at all. 2075 01:40:43.000 --> 01:40:44.560 But yeah, you don't need you don't need that shit 2076 01:40:44.880 --> 01:40:46.880 by that after you bought everything else, but don't carry 2077 01:40:46.920 --> 01:40:49.800 your daily carry and the tool that everyone should. 2078 01:40:49.600 --> 01:40:50.279 Have on them at all times. 2079 01:40:50.359 --> 01:40:54.720 Yeah, two more answer the best the best two things available. 2080 01:40:55.720 --> 01:40:59.119 Traveler hook which is used for getting latches on doors, 2081 01:40:59.720 --> 01:41:02.800 and it's called an underdoor tool, and they both have 2082 01:41:02.960 --> 01:41:05.039 their pros and cons. I'll tell you a traveler hook 2083 01:41:05.239 --> 01:41:06.640 I got my I got my wallet. 2084 01:41:06.720 --> 01:41:07.279 Right here. 2085 01:41:08.680 --> 01:41:11.840 In my wallet is a small skeletonized version of a 2086 01:41:11.880 --> 01:41:15.119 traveler hook. It doesn't have a big chonky handle. My 2087 01:41:15.159 --> 01:41:18.319 buddy in Scotland makes these. He calls these the skeleton hook. 2088 01:41:18.720 --> 01:41:20.199 But it's this is just you saw. I just pulled 2089 01:41:20.199 --> 01:41:22.279 it out of my wallet and it just I'll get 2090 01:41:22.359 --> 01:41:23.600 doors open with this all the time. 2091 01:41:24.479 --> 01:41:26.439 The other one that's hard, I mean the underdoor tool. 2092 01:41:26.479 --> 01:41:28.880 If anyone out there has seen an underdoor tool, they're 2093 01:41:29.079 --> 01:41:33.199 devastatingly effective, not easy to carry around. 2094 01:41:33.199 --> 01:41:33.640 They're big. 2095 01:41:34.199 --> 01:41:37.000 Now I happen to have an underdoor tool as well. 2096 01:41:37.199 --> 01:41:41.239 It's in my belt because I have. I'm there's a 2097 01:41:41.239 --> 01:41:44.119 whole video. It's a tiny video I talked about where 2098 01:41:44.439 --> 01:41:46.920 I literally found a belt manufacturer that would do exactly 2099 01:41:46.960 --> 01:41:49.239 what I wanted and make a belt with a long 2100 01:41:49.279 --> 01:41:53.279 cavity in it. I tried money belts, but they weren't 2101 01:41:53.279 --> 01:41:55.800 they weren't enough space. But yeah, we have the We 2102 01:41:55.840 --> 01:41:57.960 have underdoor tools that you can whip out of a belt. 2103 01:41:58.239 --> 01:42:00.760 It's as good as a big commercial underdoor tool. No, 2104 01:42:01.640 --> 01:42:03.840 but if I could give that's my gift to the world. 2105 01:42:03.880 --> 01:42:05.520 I want to give everyone the ability to have an 2106 01:42:05.600 --> 01:42:07.920 underdoor tool on them at all times if they want it. 2107 01:42:08.720 --> 01:42:12.199 And I always travel with mine. Traveler hook a undoor 2108 01:42:12.199 --> 01:42:13.680 tool for remedies for. 2109 01:42:13.680 --> 01:42:16.039 People who might not know what those are. Can you 2110 01:42:16.039 --> 01:42:20.960 give us a real quick brief description of what each does? 2111 01:42:20.640 --> 01:42:23.039 Yeh sure? 2112 01:42:23.600 --> 01:42:26.279 So the traveler hook, as if anyone was watching the 2113 01:42:26.359 --> 01:42:29.000 video part of this, it's a small tool with a 2114 01:42:29.039 --> 01:42:31.479 tiny probe sticking off the end of it. It's a 2115 01:42:31.520 --> 01:42:35.279 tiny right angle hook. If you want a really cheap 2116 01:42:35.359 --> 01:42:37.640 version of them. You can grab some o ring picks 2117 01:42:37.800 --> 01:42:40.479 at your local hazard fart or home desk spot or 2118 01:42:40.479 --> 01:42:43.439 something like that. Those are going to be cheaper steel, 2119 01:42:43.560 --> 01:42:45.199 and they're going to be too thick to. 2120 01:42:45.399 --> 01:42:47.079 I think the shafts on those are too thick to. 2121 01:42:47.279 --> 01:42:49.159 That's why if you want to get a nice version, 2122 01:42:49.199 --> 01:42:51.479 you get like a proper traveler hook from US or 2123 01:42:51.520 --> 01:42:54.600 from Lockmaster sells them. I think Mark Baits sells them. 2124 01:42:55.640 --> 01:42:58.840 But yeah, you reach into a door jam and you 2125 01:42:58.880 --> 01:43:02.239 can manipulate the on the door. If the latch is 2126 01:43:02.279 --> 01:43:05.560 not dead latching correctly, which is a very perennial problem, 2127 01:43:05.800 --> 01:43:08.159 you can slip many doors open with a traveler rook 2128 01:43:08.720 --> 01:43:09.960 an underdoor tool. 2129 01:43:10.359 --> 01:43:12.640 As it sounds it reaches beneath a door. 2130 01:43:13.079 --> 01:43:18.239 But the idea is modern building code, ADA code, Fire code. 2131 01:43:18.319 --> 01:43:22.359 All these various codes require egress is always allowed. 2132 01:43:22.399 --> 01:43:25.119 Free egress from a building should never be denied or impeded, 2133 01:43:26.199 --> 01:43:28.199 so you can have all the locks and access control 2134 01:43:28.279 --> 01:43:30.720 you want on the outside of a door. If someone's 2135 01:43:30.800 --> 01:43:34.560 inside trying to leave, I mean there's rules, there's laws 2136 01:43:34.560 --> 01:43:38.039 and rules around this. It's single motion, a single pushing 2137 01:43:38.079 --> 01:43:40.920 or twisting motion on a door handle. There's actually for 2138 01:43:41.039 --> 01:43:44.199 ada reasons. It's poundage of pressure, how many foot pounds 2139 01:43:44.199 --> 01:43:46.479 and inch pounds of so forth of torque and push, 2140 01:43:46.960 --> 01:43:48.880 so it's very light pressure on the inside of a 2141 01:43:48.920 --> 01:43:50.840 door shall cause the door to unlock. 2142 01:43:51.039 --> 01:43:51.960 On the operable part. 2143 01:43:53.039 --> 01:43:56.119 An underdoor tool is a long rod that reaches up 2144 01:43:56.640 --> 01:43:59.239 under the door, swings back towards the door, and you 2145 01:43:59.359 --> 01:44:01.600 yank down on a cord and you're trying to hit 2146 01:44:01.800 --> 01:44:05.640 the handle, the inside handle, but you yourself are on the 2147 01:44:05.640 --> 01:44:08.119 outside of the door. And if you can trip that, 2148 01:44:08.199 --> 01:44:11.239 what's called the operable part of the door. Meaningfully, it's 2149 01:44:11.359 --> 01:44:14.359 a lever style handle that will trigger the door to release. 2150 01:44:15.039 --> 01:44:17.359 And if you have a long enough rod and a 2151 01:44:17.399 --> 01:44:18.960 string on the end of it, and you know how 2152 01:44:19.000 --> 01:44:22.880 to use it, you can pop open the vast majority 2153 01:44:22.920 --> 01:44:26.279 of commercial doors in all the buildings that you travel. 2154 01:44:25.960 --> 01:44:26.680 Through all the time. 2155 01:44:27.159 --> 01:44:31.279 Sounds much easier to use than a wire coat hangar 2156 01:44:31.479 --> 01:44:34.439 undone with five point fifty core tied around the top 2157 01:44:34.479 --> 01:44:34.720 of it. 2158 01:44:35.520 --> 01:44:37.279 I've seen people do it, though, you know, you make 2159 01:44:37.359 --> 01:44:39.439 use of what you got. Provis adaptance would come. 2160 01:44:39.640 --> 01:44:46.319 Yeah, for sure. And then the other question was, thank 2161 01:44:46.359 --> 01:44:49.800 you very much. One question for him, how was how 2162 01:44:49.840 --> 01:44:54.439 has physical pen testing evolved in the age of ubiquitous 2163 01:44:54.479 --> 01:44:57.600 technical surveillance, where the opportunity for traps back by all 2164 01:44:57.680 --> 01:45:01.319 kinds of sensors covering the entire spectrum are widely available 2165 01:45:01.319 --> 01:45:04.439 in easy disguise. As a defender, I actually have the 2166 01:45:04.439 --> 01:45:07.720 impression that it wouldn't be overly difficult to design a 2167 01:45:07.840 --> 01:45:10.880 room designed to hold secrets that would be a nightmare 2168 01:45:10.960 --> 01:45:14.680 to try to approach covertly. Is that notion particularly off 2169 01:45:14.720 --> 01:45:17.720 base in your opinion experience? And I'm also just curious 2170 01:45:17.800 --> 01:45:20.079 to hear your opinion on how traps have evolved from 2171 01:45:20.079 --> 01:45:23.920 the days of analog only solutions like matchstick in the doorway, 2172 01:45:24.199 --> 01:45:26.079 you know, a piece of hair on the you know, 2173 01:45:29.239 --> 01:45:30.159 resting something. 2174 01:45:30.000 --> 01:45:34.159 Absolutely true, absolutely true. And in fact, if you go 2175 01:45:34.279 --> 01:45:38.840 to these major trade shows nowadays, for example, Millipole, the 2176 01:45:38.880 --> 01:45:43.640 Military and Police Expo is one ISC, the C trade show, 2177 01:45:44.680 --> 01:45:47.680 the Security Controls trade shows, I C West and IIC East. 2178 01:45:48.159 --> 01:45:50.000 We're always out IC West. Out here in Vegas, we're 2179 01:45:50.000 --> 01:45:53.920 always out I. You'll see loads of vendors. Now, I mean, 2180 01:45:54.000 --> 01:45:57.520 AI is a hot topic, so they're shoving AI into everything. Sure, 2181 01:45:57.520 --> 01:46:00.000 but the idea is if you put enough camera coverage, 2182 01:46:00.439 --> 01:46:04.119 just visual camera coverage in a space. We are just 2183 01:46:04.199 --> 01:46:09.119 about at the point where you can, in theory, give 2184 01:46:09.239 --> 01:46:11.720 us a technological solution a list of people who belong 2185 01:46:11.760 --> 01:46:14.920 in the building. Now you're giving away a lot of 2186 01:46:14.960 --> 01:46:17.960 your biometric data to an employer, possibly a third party 2187 01:46:18.000 --> 01:46:20.159 that the employer has hired, So take that as you will. 2188 01:46:20.840 --> 01:46:22.920 And there's a lot there's a lot of cost in 2189 01:46:22.920 --> 01:46:25.840 installing all this, and there's probably a subscription plan involved. 2190 01:46:26.600 --> 01:46:29.880 But there are schools now and I don't know how 2191 01:46:29.880 --> 01:46:31.319 I feel about this with kids and all of our 2192 01:46:31.399 --> 01:46:34.960 kids biometric data being saved by some firm that doesn't 2193 01:46:34.960 --> 01:46:37.359 have their best interest at hart probably, But there are 2194 01:46:37.399 --> 01:46:39.880 schools where if anybody shows up in the school and 2195 01:46:39.920 --> 01:46:43.199 they're not in like the face database, it throws an 2196 01:46:43.239 --> 01:46:46.000 alert on a screen and the resource officer or some 2197 01:46:46.039 --> 01:46:47.920 teacher gets sent down that hallway and it's like, Hi, 2198 01:46:48.039 --> 01:46:48.760 what are you doing here? 2199 01:46:48.800 --> 01:46:50.239 Are you here to pick somebody up? How did you 2200 01:46:50.279 --> 01:46:50.520 get in? 2201 01:46:51.479 --> 01:46:55.479 It is absolutely a huge challenge, but that's only as 2202 01:46:55.520 --> 01:46:58.399 good as the systems that are employing it. 2203 01:46:58.399 --> 01:47:01.159 We've seen that a can hallucinate. 2204 01:47:01.239 --> 01:47:03.920 We've seen that something I remember there were early days 2205 01:47:03.920 --> 01:47:08.720 of facial recognition somebody. Basically there was a man with 2206 01:47:08.760 --> 01:47:12.000 a beard and he wore long like shoulder duster earrings. 2207 01:47:13.159 --> 01:47:16.920 So the fact that he was very mask presenting. He 2208 01:47:17.079 --> 01:47:20.920 had masculine facial features, but he was wearing something accessories 2209 01:47:20.960 --> 01:47:22.119 that were very fem coded. 2210 01:47:22.920 --> 01:47:25.199 The system completely didn't know what to make of it. 2211 01:47:25.199 --> 01:47:26.960 It broke on like the line the first line of 2212 01:47:27.000 --> 01:47:31.800 code couldn't classify him by gender, and like the system 2213 01:47:31.840 --> 01:47:35.319 just failed. So we're probably going to continue to see 2214 01:47:35.760 --> 01:47:38.439 oddities and edge cases like that, which brings us back 2215 01:47:38.479 --> 01:47:41.000 to the importance of testing. All these vendors out there 2216 01:47:41.039 --> 01:47:44.319 should be engaging the hacker community and the researcher community 2217 01:47:44.800 --> 01:47:47.840 and inviting them to test these systems, because it just 2218 01:47:47.880 --> 01:47:50.279 takes one person to say, what if I wear my 2219 01:47:50.359 --> 01:47:53.560 hat and I put a really really freaking bright ir 2220 01:47:53.760 --> 01:47:56.800 led under the brim of the hat, and people did 2221 01:47:56.800 --> 01:48:00.000 that to defeat facial recognition for years. You're walking along 2222 01:48:00.039 --> 01:48:01.920 the street and that just you don't your naked eye 2223 01:48:01.960 --> 01:48:04.079 just sees a person, but all the cameras just saw 2224 01:48:04.079 --> 01:48:06.680 a huge white blob over the It was just blew 2225 01:48:06.720 --> 01:48:08.880 out the levels of the camera. The automatic game control 2226 01:48:08.880 --> 01:48:09.680 of the camera didn't work. 2227 01:48:10.920 --> 01:48:13.479 Yeah, fascinating. I got a couple others here. 2228 01:48:13.880 --> 01:48:16.680 Alex asks, how did you get to know Carl in 2229 01:48:16.760 --> 01:48:18.000 the in Range crew. 2230 01:48:19.720 --> 01:48:22.239 Hell yeah, I just saw Carl. I was just at 2231 01:48:22.319 --> 01:48:25.000 High Desert Brutality. I just flew back from Idaho right 2232 01:48:25.079 --> 01:48:30.119 like yesterday. So Carl also, Carl Cassard an amazing person, 2233 01:48:30.199 --> 01:48:34.159 wonderful human, smart guy. He is not just a firearms person. 2234 01:48:34.159 --> 01:48:35.960 I mean he came from the acker world. He was 2235 01:48:36.640 --> 01:48:39.279 in the tech world. He was a SIS admin and 2236 01:48:39.279 --> 01:48:42.039 a network guy for years. That's how he made his bones. 2237 01:48:43.319 --> 01:48:43.960 He was around. 2238 01:48:44.000 --> 01:48:46.239 I mean, he'll tell stories back when Operation Sun Devil 2239 01:48:46.319 --> 01:48:48.960 was a big hacker crackdown and he witnessed all of 2240 01:48:48.960 --> 01:48:51.800 that go down, and he remembers running and securing systems 2241 01:48:51.800 --> 01:48:55.119 at the time. So Carl was aware of def Con 2242 01:48:55.880 --> 01:48:58.079 and he had heard of this thing that I ran 2243 01:48:58.239 --> 01:49:01.199 with firearms for years. I ran was called the Deafcon Shoot. 2244 01:49:01.359 --> 01:49:03.199 Still exists. Other people run it now. I've turned it 2245 01:49:03.239 --> 01:49:06.159 over to them after a decade, and he and a 2246 01:49:06.199 --> 01:49:09.359 former colleague of his, they came out to the deaf 2247 01:49:09.439 --> 01:49:11.319 Coon Shoot just to see what it was about. 2248 01:49:11.359 --> 01:49:13.199 They said, Hey, it's in Vegas. We're in Arizona. Let's 2249 01:49:13.239 --> 01:49:13.760 just drive up. 2250 01:49:14.079 --> 01:49:17.000 And he and I met at Defcon and I instantly said, oh, 2251 01:49:17.039 --> 01:49:19.359 you're like, you're a cool guy. You're injured this stuff. 2252 01:49:19.359 --> 01:49:22.279 I'm into what you're into. Let's keep talking. And we 2253 01:49:22.399 --> 01:49:24.319 just kept coming to each other's events. Ever since then, 2254 01:49:24.319 --> 01:49:26.880 he's come back to deaf Con several times. I've gone 2255 01:49:26.880 --> 01:49:30.399 to his firearms events again. Show notes click down below. 2256 01:49:30.399 --> 01:49:32.239 I'm sure you'll drop a link to in Range TV. 2257 01:49:33.479 --> 01:49:36.840 It's one of the very very few people in the 2258 01:49:36.880 --> 01:49:40.800 firearms space that is not monetized and they're not doing 2259 01:49:40.840 --> 01:49:45.359 a lot of corporate shilling. Most influencers in the gun world, 2260 01:49:45.760 --> 01:49:48.079 there's a lot of there's a lot of money and 2261 01:49:49.239 --> 01:49:52.279 pay for play reviews going on, and Carl's out there 2262 01:49:52.319 --> 01:49:54.560 just in his own backyard in Arizona doing mud tests 2263 01:49:54.560 --> 01:49:57.399 with a bucket of water in the Arizona sand and saying, Yep, 2264 01:49:57.439 --> 01:49:58.239 this gun failed. 2265 01:49:58.560 --> 01:50:00.239 Sorry, I don't know what to tell you, MANUF sure 2266 01:50:00.279 --> 01:50:01.720 send it to me. I'm sending it to They'll make 2267 01:50:01.760 --> 01:50:02.880 a change, they'll send me another one. 2268 01:50:03.159 --> 01:50:06.720 So he's a very honest, very upstanding guy, and yeah, 2269 01:50:06.720 --> 01:50:08.720 we've been friends forever. I visit him, I visit him 2270 01:50:08.720 --> 01:50:11.000 at his place. We travel places together. He's he's one 2271 01:50:11.000 --> 01:50:11.720 of my favorite people. 2272 01:50:12.279 --> 01:50:12.760 Uh. 2273 01:50:12.840 --> 01:50:16.760 One last one from m Corbin. He asks, what is 2274 01:50:16.800 --> 01:50:18.159 your favorite fiction author? 2275 01:50:20.560 --> 01:50:29.279 Favorite fictional author. 2276 01:50:23.119 --> 01:50:31.000 The writer of fiction, not actual fictional author. Yes, yes, yes, 2277 01:50:32.079 --> 01:50:33.720 Douglas Adams is going to be up there. 2278 01:50:34.199 --> 01:50:38.119 I find that the Hitchhiker's Guys series and the lesser 2279 01:50:38.159 --> 01:50:40.920 known works the Dirt Chanley's Detective Agency and such. 2280 01:50:41.520 --> 01:50:44.159 Uh Dirt, you know, the Douglas Adams books. 2281 01:50:44.319 --> 01:50:49.840 They have this wonderful lightheartedness to them, a spirit of 2282 01:50:49.880 --> 01:50:54.439 adventure and positivity that's just full of warmth. The world 2283 01:50:54.479 --> 01:50:57.600 is a lesser place without Douglas Adams around. My wife 2284 01:50:57.640 --> 01:51:00.600 would mention, you know, things like Pratchett and other sci 2285 01:51:00.600 --> 01:51:03.199 fi authors that she you know, she's a much bigger 2286 01:51:03.199 --> 01:51:04.960 fan of and tries to get me involved. I tried 2287 01:51:04.960 --> 01:51:07.880 to watch Dune recently. I tried to, you know, I 2288 01:51:07.960 --> 01:51:09.680 watched The Lord of the Rings with her. I'm I 2289 01:51:09.760 --> 01:51:13.800 understand Tolkien's amazing world building, but there's something about the 2290 01:51:13.880 --> 01:51:17.399 lightheartedness and the smile that I will reread. 2291 01:51:17.239 --> 01:51:19.239 Adams's work to this day. 2292 01:51:19.439 --> 01:51:19.840 Yeah. 2293 01:51:20.000 --> 01:51:23.159 I used to really love Richard Morgan, The British author 2294 01:51:23.239 --> 01:51:26.279 Richard Morgan British Scottish British Richard Morgan, I wrote the 2295 01:51:26.279 --> 01:51:31.640 Altered Carbon series. Yeah, yeah, not not the most progressive 2296 01:51:31.680 --> 01:51:34.159 views on some issues that are very dear to people 2297 01:51:34.199 --> 01:51:34.760 in my life. 2298 01:51:35.439 --> 01:51:38.039 I have a trans daughter, so like, no, don't, don't, don't, 2299 01:51:38.039 --> 01:51:40.279 don't promote Richard Morgan as much anymore. I think Douglas 2300 01:51:40.319 --> 01:51:42.119 Adams would have been fine with her though, So yeah, 2301 01:51:42.159 --> 01:51:43.439 Douglas Adams gets my vote. 2302 01:51:43.680 --> 01:51:44.000 Yeah. 2303 01:51:44.920 --> 01:51:49.920 I And last thing, I guess, Deviant Dave, do you 2304 01:51:50.000 --> 01:51:55.159 have anything before we what Deviant plug his company and 2305 01:51:55.199 --> 01:51:55.760 website and. 2306 01:51:56.000 --> 01:51:58.640 Not at all. Would just like to remind you, like 2307 01:51:58.760 --> 01:52:01.079 when we say we're out of you don't mind hanging out. 2308 01:52:01.199 --> 01:52:05.319 And if you're watching this recorded, you could be watching 2309 01:52:05.319 --> 01:52:09.560 this live if you're a Patreon subscriber and we're going 2310 01:52:09.640 --> 01:52:15.159 to do a teamhouse after dark, just a fun little 2311 01:52:15.199 --> 01:52:19.680 story or whatever for our patron subscribers afterwards. But please 2312 01:52:19.840 --> 01:52:20.560 go ahead, Jack. 2313 01:52:20.760 --> 01:52:24.399 So Devian tell people out there where they can go 2314 01:52:24.880 --> 01:52:28.359 to procure your services if they want you to break 2315 01:52:28.399 --> 01:52:31.479 into their home place of employment. 2316 01:52:32.079 --> 01:52:33.720 I bust open a's safe. 2317 01:52:34.199 --> 01:52:36.600 Tell them about the classes that you offer and where 2318 01:52:36.640 --> 01:52:38.800 they can find you guys. 2319 01:52:38.840 --> 01:52:42.399 Sure, so yes, on the internet, I am Devian Olaf 2320 01:52:42.720 --> 01:52:45.760 spelled not at all like it sounds. So yeah, you'll 2321 01:52:45.760 --> 01:52:48.319 see my name in the episode. But I'm on all 2322 01:52:48.399 --> 01:52:52.319 of the things as my user name, so YouTube. But 2323 01:52:52.640 --> 01:52:55.039 I'm not on Twitter. No one's on Twitter anymore. But 2324 01:52:55.640 --> 01:52:58.640 you know blue Sky mast it on Instagram read it. 2325 01:52:58.800 --> 01:52:59.600 I have a GitHub. 2326 01:53:00.119 --> 01:53:03.079 The professional side of things, my one company is called 2327 01:53:03.079 --> 01:53:05.479 the core Group, so Bobbic and I have been running 2328 01:53:05.479 --> 01:53:06.640 the core Group since twenty ten. 2329 01:53:06.920 --> 01:53:09.479 We're at the core Group dot net. That's if you 2330 01:53:09.479 --> 01:53:11.960 want us to break in, if you want to learn 2331 01:53:11.960 --> 01:53:15.079 how to break in, it's going to be a Red 2332 01:53:15.079 --> 01:53:15.800 Team Alliance. 2333 01:53:15.960 --> 01:53:19.640 So Redteamalliance dot com. This I'm literally sitting the reason 2334 01:53:19.720 --> 01:53:22.640 I'm in such a baar weird white box. We got 2335 01:53:22.720 --> 01:53:26.239 the keys yesterday morning to our new building in Vegas. 2336 01:53:26.439 --> 01:53:29.479 We're all out here moving in, so all the teams downstairs, 2337 01:53:29.520 --> 01:53:31.319 the moving trucks have been rolling all day. Hopefully you 2338 01:53:31.319 --> 01:53:33.680 haven't heard the garage doors rolling up and down outside. 2339 01:53:34.479 --> 01:53:34.720 Yeah. 2340 01:53:34.800 --> 01:53:38.399 So Redteamalliance dot com. Our full training calendar is online. 2341 01:53:38.479 --> 01:53:40.560 We have our Vegas facility. We have our facility in 2342 01:53:40.600 --> 01:53:44.000 Virginia near DC. We have classes in Australia at Europe 2343 01:53:44.039 --> 01:53:47.119 as well if you want to buy stuff. You know, 2344 01:53:47.439 --> 01:53:50.359 I never like mention in our retail catalog. I feel 2345 01:53:50.399 --> 01:53:51.880 like such a shill. It's not my I wouldn't say 2346 01:53:51.880 --> 01:53:53.920 it on my channels on social media. But Red Team 2347 01:53:53.920 --> 01:53:56.880 Tools all the equipment and gear that I make and 2348 01:53:56.960 --> 01:53:59.800 design and have changed over the years. Here's a fun one. 2349 01:54:00.680 --> 01:54:04.199 This was a product that literally existed and no longer does. 2350 01:54:04.279 --> 01:54:06.880 And I bring things back from the dead. So we 2351 01:54:06.960 --> 01:54:09.279 have these kind of in people's kits in the field. 2352 01:54:09.880 --> 01:54:12.399 You just this is a fence climber. 2353 01:54:12.520 --> 01:54:14.760 You stick it through a fence, you drop it and 2354 01:54:14.800 --> 01:54:17.159 it hangs and you can go up one side down 2355 01:54:17.199 --> 01:54:18.880 the other. You get a couple of these in your pocket, 2356 01:54:19.199 --> 01:54:19.560 and you. 2357 01:54:19.520 --> 01:54:21.800 Know, eight ballot you name. 2358 01:54:21.640 --> 01:54:24.039 However, how the fences are. You're up and over in 2359 01:54:24.119 --> 01:54:26.960 no time, even my fat ass. So that's all on 2360 01:54:27.000 --> 01:54:29.840 Red Team Tools dot com. You always yeah, the board 2361 01:54:29.840 --> 01:54:32.359 group in Red Team Alliance. So the most useful. 2362 01:54:32.159 --> 01:54:33.760 Fantastic I was going to say that you always need 2363 01:54:33.800 --> 01:54:35.600 something like Jack to go over first though, to lay 2364 01:54:35.640 --> 01:54:38.640 down on the concertina at the top, so then you 2365 01:54:38.680 --> 01:54:39.880 go up climb over them. 2366 01:54:44.199 --> 01:54:45.560 Harder to do all that nowadays. 2367 01:54:45.560 --> 01:54:48.319 I mean, we have friends at Magnosphere who the fence 2368 01:54:48.359 --> 01:54:52.119 sensor technology. The shake sensors are getting really subtle, and 2369 01:54:52.199 --> 01:54:54.199 I could I even I did an experiment where I said, 2370 01:54:54.319 --> 01:54:56.319 I wonder if it would detect going over the fence. 2371 01:54:56.479 --> 01:54:58.479 I bet it will, And the guy was like, it's 2372 01:54:58.479 --> 01:55:01.479 going to detect you putting it on the and sure enough. 2373 01:55:01.560 --> 01:55:02.199 Yeah, we watched. 2374 01:55:02.239 --> 01:55:04.000 You can watch the little line go up on their graph. 2375 01:55:04.079 --> 01:55:05.680 He's like, yeah, you're just touching the fence. 2376 01:55:05.760 --> 01:55:06.079 Was enough. 2377 01:55:06.079 --> 01:55:07.159 You're not getting over that. 2378 01:55:07.159 --> 01:55:12.880 That's amazing. That's amazing. Yeah, So definitely check out Devian's 2379 01:55:13.159 --> 01:55:17.600 the classes, the company and the videos. Like everything on 2380 01:55:17.640 --> 01:55:21.680 YouTube is just fantastic. So I highly recommend people track 2381 01:55:21.720 --> 01:55:24.039 you down and watch all of that. Absolutely, thank you. 2382 01:55:24.479 --> 01:55:26.520 A lot of I mean my channel now must I've 2383 01:55:26.520 --> 01:55:28.720 been on YouTube since two thousand and nine. There's a 2384 01:55:28.760 --> 01:55:30.800 lot of crap on there, but the long I find 2385 01:55:30.800 --> 01:55:32.640 a lot of people like the long form ste so 2386 01:55:32.800 --> 01:55:36.359 my lectures when I've actually given presentations. There's maybe a 2387 01:55:36.399 --> 01:55:39.119 dozen or more hour long videos on my channel that's 2388 01:55:39.119 --> 01:55:40.439 all my professional. 2389 01:55:39.920 --> 01:55:42.039 Talks, and I think it's a lot of fun, you know, 2390 01:55:43.000 --> 01:55:45.039 you talked in the beginning about you know, kids not 2391 01:55:45.199 --> 01:55:47.760 having space anymore, and like I remember when I was 2392 01:55:48.079 --> 01:55:51.159 maybe like in junior high, like breaking into a school 2393 01:55:51.279 --> 01:55:53.520 over the summer, like going in through the top, and 2394 01:55:53.720 --> 01:55:55.960 we weren't destroying anything, we weren't stealing anything. It was 2395 01:55:56.039 --> 01:55:58.600 just the thrill of being able to get in, right 2396 01:55:58.680 --> 01:56:04.119 and you're in, and like you're in. Yeah, and you still, 2397 01:56:04.199 --> 01:56:05.880 like a lot of your videos, you still have that 2398 01:56:05.960 --> 01:56:09.159 thrill of discovery, like when you're when you're presented with 2399 01:56:09.199 --> 01:56:11.520 a new challenge, a new technology, a new type of 2400 01:56:11.560 --> 01:56:16.439 door sensor, you know, you know, like because it has 2401 01:56:16.479 --> 01:56:18.600 to open from one side and put in gas or 2402 01:56:18.640 --> 01:56:21.239 putting blowing up a balloon or whatever on the other 2403 01:56:21.279 --> 01:56:23.520 side of the door. Like there's still a lot of that, 2404 01:56:24.560 --> 01:56:27.680 I don't know, like that that sense, that childlike sense 2405 01:56:27.680 --> 01:56:31.279 of exploration, like oh, let's let's here's a new puzzle, 2406 01:56:31.359 --> 01:56:37.680 let's solve it. Absolutely yeah, all right, guys. Uh so 2407 01:56:37.920 --> 01:56:40.800 we will see all of you next time. Thank you 2408 01:56:40.800 --> 01:56:43.600 for joining us, Thank you deviant And you can find 2409 01:56:43.680 --> 01:56:46.720 all the links down the description that we mentioned on 2410 01:56:46.800 --> 01:56:50.760 the show, and uh for our Patreon subscribers, stick around 2411 01:56:50.760 --> 01:56:53.680 because there's a little bit more. It's gonna get spicy. 2412 01:56:55.079 --> 01:56:56.520 All right, I'm gonna leave it running. 2413 01:56:56.560 --> 01:56:59.880 D can cut the film, Oh right, right, because we can, 2414 01:57:00.079 --> 01:57:00.479 we can roll. 2415 01:57:00.560 --> 01:57:03.640 Right, that's right, that's right, because we're not live for anybody. 2416 01:57:03.760 --> 01:57:08.880 But patron, Uh, do you do you have I know, 2417 01:57:08.920 --> 01:57:10.319 I kind of put you on a spot to you 2418 01:57:10.399 --> 01:57:12.399 but we're still rolling. We're still live to the patron. 2419 01:57:12.439 --> 01:57:16.000 But uh, do you do you have something in mind? 2420 01:57:16.960 --> 01:57:17.359 Uh? 2421 01:57:18.039 --> 01:57:21.119 A story or a vignette or anything. 2422 01:57:21.840 --> 01:57:23.600 Oh, a story from from my end? 2423 01:57:23.960 --> 01:57:27.119 Yeah, so, and I said, it can be you know, 2424 01:57:27.600 --> 01:57:31.079 it could be something that a time went bad, a 2425 01:57:31.159 --> 01:57:34.720 time went really good, a time something weird happened. Yeah, 2426 01:57:34.800 --> 01:57:35.439 weirdest things. 2427 01:57:35.520 --> 01:57:38.000 I mean, there's a story I've I've told once or twice. 2428 01:57:38.279 --> 01:57:40.560 But my one of my favorite jobs was a job 2429 01:57:40.600 --> 01:57:46.119 we completely had no success and it was a small 2430 01:57:46.279 --> 01:57:48.199 company in the in the middle of America. It was 2431 01:57:48.239 --> 01:57:51.840 a Middle America Nowheresville. And some people say, oh, you 2432 01:57:51.880 --> 01:57:54.479 know these po dunk town that you're gonna put one 2433 01:57:54.520 --> 01:57:56.520 over on those roobs. I mean, no one really says 2434 01:57:56.560 --> 01:57:59.319 something rude, but uh, there's there's a certain kind of 2435 01:57:59.319 --> 01:58:01.880 thinking that says, well, small companies, you know, these people, 2436 01:58:01.920 --> 01:58:05.039 they're not They're not going to have sophisticated security systems. 2437 01:58:05.279 --> 01:58:07.159 And they didn't. They didn't have a lot of big budget, they. 2438 01:58:07.039 --> 01:58:09.399 Didn't have all the the whiz bang stuff that you 2439 01:58:09.520 --> 01:58:14.319 see at the trade shows. What they had was a 2440 01:58:14.359 --> 01:58:16.640 dedicated team of staff, many of whom had worked there 2441 01:58:16.680 --> 01:58:20.359 for decades, and they just they had emotional investment in 2442 01:58:20.399 --> 01:58:24.119 what they were doing. This was it was an agribusiness essentially, 2443 01:58:24.479 --> 01:58:26.680 so they were American food supply right like this is 2444 01:58:26.760 --> 01:58:29.319 it's I would consider critical to our nation's health and 2445 01:58:29.359 --> 01:58:33.600 well being. I was very hopeful that their security would 2446 01:58:33.600 --> 01:58:35.720 be robust, but it was, and where I wasn't expecting. 2447 01:58:36.800 --> 01:58:41.199 We came out there case the joint, did all our 2448 01:58:41.279 --> 01:58:44.600 usual recon had our cover stories. We said, all right, 2449 01:58:44.680 --> 01:58:48.119 let's find the local utility companies in town. We made badges, outfits, 2450 01:58:48.159 --> 01:58:51.000 you name it in case we were on site getting questioned. 2451 01:58:51.680 --> 01:58:53.760 So we were, you know, because of being a utility 2452 01:58:53.760 --> 01:58:55.479 company worker, you can kind of be on the buildings 2453 01:58:56.000 --> 01:58:58.800 around the grounds and no one would oh, that guy's 2454 01:58:58.840 --> 01:59:01.920 doing the he's checking out, he's you're spray painting some 2455 01:59:02.000 --> 01:59:03.159 marks in the ground a little bit. 2456 01:59:03.600 --> 01:59:04.920 So we did all this research. 2457 01:59:04.960 --> 01:59:06.560 We found a few doors that were a little bit 2458 01:59:06.560 --> 01:59:08.640 of jar and we had somebody all right, we come 2459 01:59:08.720 --> 01:59:10.840 up with an attack chain. We're gonna come in on 2460 01:59:10.880 --> 01:59:16.159 Sunday morning. Everyone's at church or watching football. We were 2461 01:59:16.159 --> 01:59:20.720 on site, walking around the premises and again looking like technicians. Right, 2462 01:59:22.359 --> 01:59:25.439 we were in this building. There's a multi building complex. 2463 01:59:25.439 --> 01:59:25.720 I remember. 2464 01:59:25.720 --> 01:59:27.359 We're in a building for maybe half an hour forty 2465 01:59:27.399 --> 01:59:32.000 five minutes tops, and somebody said on our team and say, hey, 2466 01:59:32.199 --> 01:59:34.359 there's a car in the parking lot that wasn't there earlier. 2467 01:59:34.560 --> 01:59:36.399 We look out, sure enough, Yeah there's a car. What's that? 2468 01:59:37.479 --> 01:59:40.880 And we later said, do you see who's that guy 2469 01:59:41.279 --> 01:59:43.039 looking at it? There's a guy going from building to 2470 01:59:43.159 --> 01:59:46.600 clearly going building to building, not a security guard, just 2471 01:59:46.640 --> 01:59:49.479 to just a dude whose badge worked. 2472 01:59:50.600 --> 01:59:53.359 He said, that's freaking weird. And later he came and 2473 01:59:53.399 --> 01:59:53.760 found it. 2474 01:59:53.800 --> 01:59:55.199 He found us in one of the buildings, in one 2475 01:59:55.239 --> 01:59:57.840 of the offices, and he said, hey, you know, what 2476 01:59:57.880 --> 02:00:01.119 are you guys doing in here again? So we're from 2477 02:00:01.159 --> 02:00:04.279 such and such Telecom. We were sent here. We did 2478 02:00:04.319 --> 02:00:07.279 some work at your Wyoming office. He said, we're here 2479 02:00:07.279 --> 02:00:08.239 at the Kentucky office. 2480 02:00:08.279 --> 02:00:08.439 Now. 2481 02:00:08.560 --> 02:00:10.920 He said, no, I would have heard about that. Who 2482 02:00:10.920 --> 02:00:11.800 sent you from Wyoming? 2483 02:00:12.399 --> 02:00:14.279 We knew Nately said, oh, well, Keith is the plant 2484 02:00:14.279 --> 02:00:17.039 manager over there, he does the IT infrastructure. No, I 2485 02:00:17.079 --> 02:00:18.760 don't know if Keith what I could call Keith and 2486 02:00:18.800 --> 02:00:21.640 find out. This guy was having none of it, and 2487 02:00:21.720 --> 02:00:23.439 eventually we had to We had to produce a you know, 2488 02:00:23.479 --> 02:00:25.760 always carrying a letter that says, look, we were hired 2489 02:00:25.800 --> 02:00:27.760 by this guy. The CEO knows were here, the owner 2490 02:00:27.760 --> 02:00:30.159 knows we're here, and he's like, yep, yeah, there was 2491 02:00:30.159 --> 02:00:31.239 an odor to this situation. 2492 02:00:31.319 --> 02:00:34.159 I didn't like it. We said, well, are you working today, sir? 2493 02:00:34.640 --> 02:00:37.000 He said no. I was driving through town. 2494 02:00:37.039 --> 02:00:38.840 He was literally driving down Main Street and he looked 2495 02:00:38.880 --> 02:00:42.680 at the parking lot and just driving by the buildings, 2496 02:00:43.319 --> 02:00:45.840 he saw one of our team in the parking lot. 2497 02:00:46.039 --> 02:00:48.520 He said, I don't recognize that guy. He did a 2498 02:00:48.560 --> 02:00:50.159 k turn, came back up Main. 2499 02:00:50.039 --> 02:00:53.279 Street and he said, then saw your guy badge into 2500 02:00:53.319 --> 02:00:56.800 a building. And I said, I still I don't like this. 2501 02:00:57.239 --> 02:00:59.600 And I said, wait a minute. You saw on your 2502 02:00:59.640 --> 02:01:05.239 freaking day off a person badge you with a working badge, 2503 02:01:05.640 --> 02:01:07.439 and you still didn't He's like, no, I didn't like it. 2504 02:01:07.520 --> 02:01:08.920 Some didn't like sudden didn't feel right. 2505 02:01:10.159 --> 02:01:13.520 I know companies where you could walk in and say, hi, 2506 02:01:13.600 --> 02:01:17.000 I'm here to steal everything, and the employees would say, yeah, 2507 02:01:17.119 --> 02:01:19.119 f this company. They don't care about me anyway, right 2508 02:01:19.560 --> 02:01:21.319 right care, Yeah they give a crap. 2509 02:01:21.880 --> 02:01:23.600 But this guy, I mean, he had been working there 2510 02:01:23.640 --> 02:01:26.920 for probably thirty forty years. Yeah, he knew like he 2511 02:01:27.000 --> 02:01:28.880 knew the owners. They went bowling and say he's liked. 2512 02:01:28.880 --> 02:01:31.000 No, he just had emotional investment, as did everyone at 2513 02:01:31.000 --> 02:01:34.039 this company. We were on our walk through the day 2514 02:01:34.159 --> 02:01:37.600 after we're on Monday, escort it around and at one 2515 02:01:37.600 --> 02:01:40.039 point our escort, you know, the co owner of the company, 2516 02:01:40.079 --> 02:01:42.920 his son. He left us alone to get something, and 2517 02:01:43.000 --> 02:01:44.319 a woman was like, what are you doing in this 2518 02:01:44.359 --> 02:01:45.039 wing of the building. 2519 02:01:45.359 --> 02:01:48.399 We said, oh, you know, Frank is letting us say. 2520 02:01:48.560 --> 02:01:50.039 She says, like, Frank's not here. Where's Frank? 2521 02:01:50.039 --> 02:01:51.319 You don't belong here. Come to the front with me 2522 02:01:51.399 --> 02:01:54.000 right now. And she had just been working there for you. Again, 2523 02:01:54.159 --> 02:01:55.840 she had been at the same desk for the same 2524 02:01:56.199 --> 02:02:00.039 many decades. There's a real lesson there and investing in 2525 02:02:00.079 --> 02:02:03.760 your people. I don't just mean give pizza Fridays, right, 2526 02:02:03.880 --> 02:02:06.640 I mean actually give real raises, take a real interest. 2527 02:02:07.079 --> 02:02:09.880 Are people satisfied with their job? Do they care about 2528 02:02:09.880 --> 02:02:13.720 what you're doing? That's what saved this company from everything 2529 02:02:13.720 --> 02:02:15.600 we tried to do to them. 2530 02:02:16.079 --> 02:02:18.319 Okay, I want to ask you know, I don't want 2531 02:02:18.319 --> 02:02:21.039 to keep you too long, but I want to ask 2532 02:02:21.119 --> 02:02:24.920 either for a time you were horrified by how easy 2533 02:02:25.119 --> 02:02:30.319 something important was that shouldn't have been easy, or about 2534 02:02:30.359 --> 02:02:36.279 the biggest ass chewing you ever saw because something was easy. 2535 02:02:37.439 --> 02:02:41.800 I was really sad to learn of this was a 2536 02:02:41.840 --> 02:02:43.439 biomedical research facility. 2537 02:02:44.439 --> 02:02:47.680 And ultimately they had spent a time. 2538 02:02:47.720 --> 02:02:50.479 I mean they had money coming out their years, right, 2539 02:02:51.399 --> 02:02:55.000 they had spent so much money on all their security systems, 2540 02:02:55.520 --> 02:03:02.359 but they didn't invest in a decent like badge credential technology. 2541 02:03:02.760 --> 02:03:08.720 They were still using the most outmoded, outdated hid pros credentials, 2542 02:03:09.600 --> 02:03:12.560 which had been around, you know, thirty years at this point, 2543 02:03:12.720 --> 02:03:14.159 more than that forty years probably at this point, the 2544 02:03:14.239 --> 02:03:18.560 original hip rocks and it's the most clonable badge imaginable. 2545 02:03:19.039 --> 02:03:21.520 We ultimately it was hard to clone badges. We couldn't 2546 02:03:21.520 --> 02:03:24.079 really get to the employees. They weren't around. It was 2547 02:03:24.079 --> 02:03:27.439 a very buttoned up, very tight building, but one of 2548 02:03:27.439 --> 02:03:29.479 our staff went in. One of our team went in 2549 02:03:29.800 --> 02:03:32.760 and interacted with the guards in the front lobby and 2550 02:03:32.840 --> 02:03:35.319 he was just bs and with them, and there's again 2551 02:03:35.359 --> 02:03:37.439 we talked about this in training. We had a long 2552 02:03:37.560 --> 02:03:39.880 range reader in a laptop bag and if you got 2553 02:03:39.920 --> 02:03:43.079 close enough to someone's badge, you could grab it. 2554 02:03:43.119 --> 02:03:43.840 You could because. 2555 02:03:43.760 --> 02:03:47.039 There's no encryption on the badges. You just had to 2556 02:03:47.079 --> 02:03:49.760 brush past the badge. And he was able to get 2557 02:03:49.800 --> 02:03:51.960 past one of the guards. And there's a longer version 2558 02:03:51.960 --> 02:03:54.319 of the story that I've telled us, but eventually he 2559 02:03:54.359 --> 02:03:58.279 gets near a guard, gets the guy's badge, and then 2560 02:03:58.640 --> 02:04:00.800 we just cloned it into We just got in, and 2561 02:04:00.840 --> 02:04:04.640 then we came in the next night midnight shift. There 2562 02:04:04.680 --> 02:04:06.439 was a big movie premiere. It was like the new 2563 02:04:06.560 --> 02:04:10.239 Star Wars that was coming out, like the episode Phantom 2564 02:04:10.239 --> 02:04:12.640 Menace or whatever was coming out a long time ago story, 2565 02:04:13.239 --> 02:04:14.960 but we were able to use these We just got 2566 02:04:15.000 --> 02:04:19.000 it everywhere at that point. And the lesson we later 2567 02:04:19.119 --> 02:04:22.239 learned and it can't go was two how it's not 2568 02:04:22.279 --> 02:04:25.039 always your fought's not always you can control the badges. 2569 02:04:25.079 --> 02:04:28.520 So this building that they were renting was owned by 2570 02:04:28.560 --> 02:04:32.279 a huge property management company, and they insisted, like, here's 2571 02:04:32.279 --> 02:04:33.239 the badges for the building. 2572 02:04:33.239 --> 02:04:34.880 This is the badge system right now. 2573 02:04:35.039 --> 02:04:37.039 They had other badges they could have used, but the 2574 02:04:37.439 --> 02:04:39.720 property management company made it such a pain in the ass. 2575 02:04:40.039 --> 02:04:41.359 They just said, no, we're just going to go with 2576 02:04:41.399 --> 02:04:43.439 the badges they find. We're not going to go through 2577 02:04:43.479 --> 02:04:45.600 all the legal hoops and give you copies of badges. 2578 02:04:46.119 --> 02:04:49.279 So they were locked in by some weird rental agreement. 2579 02:04:50.159 --> 02:04:52.680 But the sad part is that all that entire guard crew, 2580 02:04:53.199 --> 02:04:55.760 I won't say it got fired. They still had jobs, 2581 02:04:56.079 --> 02:04:59.359 but they lost that contract. Like the guards were all 2582 02:04:59.399 --> 02:05:02.560 cycled out, and that was part of the with the executives. 2583 02:05:02.560 --> 02:05:04.640 I can't believe the guards let you get close to that. 2584 02:05:04.680 --> 02:05:07.239 I said, come on, man, who's going to think that somebody? Right? 2585 02:05:07.439 --> 02:05:09.119 You know, we had a guy who you had to talk. 2586 02:05:09.239 --> 02:05:11.640 I said, if you had kept those guards, that would 2587 02:05:11.680 --> 02:05:13.680 be trial by fire for them. That would they would 2588 02:05:13.680 --> 02:05:16.079 be way more hardened against this kind of attack, and 2589 02:05:16.079 --> 02:05:18.840 they'd be way more poised to say, hey, I'm not 2590 02:05:18.840 --> 02:05:20.439 going to keep my badge right in front of me 2591 02:05:20.520 --> 02:05:21.359 while it's visible. 2592 02:05:21.399 --> 02:05:24.399 And you know, I think it was the wrong move. 2593 02:05:24.399 --> 02:05:26.520 I think they should that's that you want the person 2594 02:05:26.800 --> 02:05:29.239 who got caught in a stumble if they're willing to 2595 02:05:29.319 --> 02:05:30.960 learn from it and recover and get better. 2596 02:05:31.119 --> 02:05:33.600 Especially if they didn't even know that technology existed. Like 2597 02:05:33.640 --> 02:05:36.920 they're they're security guards, right, They're they're not like FBI, 2598 02:05:37.000 --> 02:05:37.800 They're not FBI. 2599 02:05:38.439 --> 02:05:38.640 You know. 2600 02:05:39.000 --> 02:05:42.800 It's yeah, yeah, it's unfortunate. Devian. Thank you, Thank you 2601 02:05:42.880 --> 02:05:46.079 very much. We really we appreciate you with us tonight. 2602 02:05:46.239 --> 02:05:46.960 It's a great time. 2603 02:05:48.000 --> 02:05:49.800 Hey, guys, I want to tell all of you today 2604 02:05:49.920 --> 02:05:53.079 about a new newsletter that we're launching that encompasses both 2605 02:05:53.199 --> 02:05:57.039 the team House podcast, the eyes On podcast, and the 2606 02:05:57.119 --> 02:06:00.560 high Side News outlet, which I run with on Naylor. 2607 02:06:01.399 --> 02:06:04.640 The newsletter is gonna be once a week. It's gonna 2608 02:06:04.640 --> 02:06:07.159 come into your inbox and you're gonna get the most 2609 02:06:07.159 --> 02:06:11.600 current podcasts on eyes On and the Teamhouse and whatever's 2610 02:06:12.159 --> 02:06:15.399 topical or current on the high Side. So it's another 2611 02:06:15.399 --> 02:06:17.079 way for us to get the information out to you 2612 02:06:17.520 --> 02:06:21.039 as social media algorithms are pretty iffy and you never 2613 02:06:21.119 --> 02:06:21.520 really know. 2614 02:06:21.479 --> 02:06:23.760 What you're gonna get. So this is a once a 2615 02:06:23.760 --> 02:06:24.399 week email. 2616 02:06:24.520 --> 02:06:26.920 It'll slide into your inbox and it will have you 2617 02:06:26.960 --> 02:06:28.479 know the greatest hits of that week. 2618 02:06:28.560 --> 02:06:29.239 It's really good. 2619 02:06:30.359 --> 02:06:30.960 Checking it out. 2620 02:06:31.880 --> 02:06:36.159 The website for it is Teamhouse Podcast, dot kit dot com, 2621 02:06:36.159 --> 02:06:41.039 slash Join, Teamhouse Podcast dot kit dot com slash Join. 2622 02:06:41.920 --> 02:06:44.039 You go there and you enter into your email list 2623 02:06:44.239 --> 02:06:47.880 or you enter your email into the little thing on 2624 02:06:47.920 --> 02:06:49.520 the website and you're good to go. 2625 02:06:49.680 --> 02:06:52.680 And that'll be it. So we really appreciate your support 2626 02:06:53.000 --> 02:06:55.640 and hope you'll consider signing up where the link. 2627 02:06:56.560 --> 02:06:58.920 The link will also be down in the description if 2628 02:06:58.920 --> 02:06:59.880 you're looking for it there 2629 02:07:00.119 --> 02:07:05.279 And that's Teamhouse Podcast, dot Kit, k I, t Kilo India, 2630 02:07:05.479 --> 02:07:09.239 Tango dot com backslash Join